76abf90f3575a023b53226ad1e4a3fe46eb409450a99ad97e53eed1912ade9cc

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 21:29

Target

EA DLC Unlocker v2/setup.bat
Size

14KB
MD5

313b65ba5a36ba99e5f05f8e060a6882
SHA1

b38eb49f908e823ef820ba4fa0f0877c3c73b324
SHA256

bdf9d9052c1beb9fab9d5e4301c7f0b63e1c3737b7e3feedaa5c3ab7a3d247d6
SHA512

00a16e970b318e67e296b1cc1067323566c3eb0e115d31bf96f60705b94458860e7619878882f708dfffb4951111a75754b46fbf93aef70333d0e187d1161336
SSDEEP

192:Q+xaM15cr4EV4cLEOqqFir1/C4BxoZIR/j/0G:r9MhqLBpf

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1148	2508	cmd.exe	84
PID 2508 wrote to memory of 1148	2508	cmd.exe	84
PID 2508 wrote to memory of 4796	2508	cmd.exe	85
PID 2508 wrote to memory of 4796	2508	cmd.exe	85
PID 2508 wrote to memory of 2392	2508	cmd.exe	86
PID 2508 wrote to memory of 2392	2508	cmd.exe	86
PID 2508 wrote to memory of 1224	2508	cmd.exe	87
PID 2508 wrote to memory of 1224	2508	cmd.exe	87
PID 2508 wrote to memory of 696	2508	cmd.exe	88
PID 2508 wrote to memory of 696	2508	cmd.exe	88
PID 2508 wrote to memory of 4720	2508	cmd.exe	89
PID 2508 wrote to memory of 4720	2508	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo marco "
  2⤵
  PID:1148
- C:\Windows\System32\findstr.exe
  findstr /C:"polo"
  2⤵
  PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo marco "
  2⤵
  PID:2392
- C:\Windows\System32\findstr.exe
  findstr /V /C:"polo"
  2⤵
  PID:1224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\" "
  2⤵
  PID:696
- C:\Windows\System32\findstr.exe
  findstr /V /C:"C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:4720