248cea4d239e6f36af672ced25e973dfceed1f14ab4c01512304af4b30493654

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
05-12-2023 17:55

Target

stodio.bat
Size

240B
MD5

eb7ab095198f2ac4bfce548fa5768f0a
SHA1

b2dfb2748f62fb6e9a4ea1318d1a0349abf7bafe
SHA256

0ee0bc61ef4263ca51688526a68cfe9a18dcb665b83fe7c61fbf03624804cc91
SHA512

9a61567e119ee5f425d41a7ac93097de5094b1c955ee8d845a3384800629658ec979660d36c366dbc620906b4444ca4f80262dcd634bb8b7e9a58ba71e015170

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2256 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2256 powershell.exe

pid	process
2256	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2256	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2136 wrote to memory of 2256	2136	cmd.exe	powershell.exe
PID 2136 wrote to memory of 2256	2136	cmd.exe	powershell.exe
PID 2136 wrote to memory of 2256	2136	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\stodio.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136

memory/2256-4-0x000000001B160000-0x000000001B442000-memory.dmp

Filesize
2.9MB

Download
memory/2256-5-0x00000000024A0000-0x00000000024A8000-memory.dmp

Filesize
32KB

Download
memory/2256-6-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2256-7-0x00000000024E0000-0x0000000002560000-memory.dmp

Filesize
512KB

Download
memory/2256-9-0x00000000024E0000-0x0000000002560000-memory.dmp

Filesize
512KB

Download
memory/2256-10-0x00000000024E0000-0x0000000002560000-memory.dmp

Filesize
512KB

Download
memory/2256-8-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2256-11-0x00000000024E0000-0x0000000002560000-memory.dmp

Filesize
512KB

Download
memory/2256-12-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download