5f265f7ec7d80f9a08881a49370a0e2274f3ea4f9661421b14d925298bc6316a

Analysis

max time kernel
145s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:30

Target

Aalesund-issue/get.aalesund.cmd
Size

330B
MD5

2dc9ce91a9e9fa863663db29d5a351c3
SHA1

27ff48f440076983e173778e8ae025f3b3ed15b4
SHA256

9df8b90b81377025b3bebcb5adca32c08decdbf0d0d16c56501b27325a9ece9c
SHA512

c93c8ac2025ecaf109fe30fc0971df3bcfcf75c401aa687c5a1f4097a2a6bc25cf6bd70d0ac79c944997d226bd5fafd2430a7906c96c6abcb3e00c2e3ff4fdc9

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/4124-0-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral4/memory/4124-1-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral4/memory/4124-2-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral4/memory/4124-3-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral4/memory/4124-4-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral4/memory/4124-5-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 4124	1304	cmd.exe	88
PID 1304 wrote to memory of 4124	1304	cmd.exe	88
PID 1304 wrote to memory of 4124	1304	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Aalesund-issue\get.aalesund.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\Aalesund-issue\wget.exe
  wget --timeout=84600 --header="Accept: text/xml" --header="Accept: multipart/*" --header="Accept: application/soap" --header="Content-Type: text/xml; charset=utf-8" --post-file=get.aalesund.request.xml http://localhost:8080/ifcquery/earlybinding/myrepo/mymodel/QEX/ifc_graphic_adapter --output-document=get.aalesund.response.xml
  2⤵
  PID:4124

memory/4124-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4124-1-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4124-2-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4124-3-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4124-4-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4124-5-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download