5f265f7ec7d80f9a08881a49370a0e2274f3ea4f9661421b14d925298bc6316a

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:30

Target

Aalesund-issue/get.aalesund.cmd
Size

330B
MD5

2dc9ce91a9e9fa863663db29d5a351c3
SHA1

27ff48f440076983e173778e8ae025f3b3ed15b4
SHA256

9df8b90b81377025b3bebcb5adca32c08decdbf0d0d16c56501b27325a9ece9c
SHA512

c93c8ac2025ecaf109fe30fc0971df3bcfcf75c401aa687c5a1f4097a2a6bc25cf6bd70d0ac79c944997d226bd5fafd2430a7906c96c6abcb3e00c2e3ff4fdc9

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2192-0-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral3/memory/2192-1-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral3/memory/2192-2-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral3/memory/2192-3-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2192	wget.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2192	2540	cmd.exe	29
PID 2540 wrote to memory of 2192	2540	cmd.exe	29
PID 2540 wrote to memory of 2192	2540	cmd.exe	29
PID 2540 wrote to memory of 2192	2540	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Aalesund-issue\get.aalesund.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\Aalesund-issue\wget.exe
  wget --timeout=84600 --header="Accept: text/xml" --header="Accept: multipart/*" --header="Accept: application/soap" --header="Content-Type: text/xml; charset=utf-8" --post-file=get.aalesund.request.xml http://localhost:8080/ifcquery/earlybinding/myrepo/mymodel/QEX/ifc_graphic_adapter --output-document=get.aalesund.response.xml
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2192

memory/2192-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2192-1-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2192-2-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2192-3-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download