fc2d9db6c4b4934568725f739fa2ad468bbbc54d9fa9d0e5380ede2d7d395be9

Analysis

max time kernel
159s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 19:35

Target

BatchFiles.exe
Size

2.1MB
MD5

d72a038cd1f874bd038bbd4047351b8d
SHA1

b53ac279cdc5f6e01fbc350b943abfae2476d0df
SHA256

40cb1a3c88b619984a4562e4fc8e4a6b71c7c6f402b586bf99a88560b0d1a3f2
SHA512

3a36e4951257f808055f7853fda707ac608f3a14e7c8997310cd4026603af5db55a2adc16a3db184ca007d7814618eb6e8c65012407f552831ca78c13586b8ac
SSDEEP

49152:H221BTRryZIj1EY7raiV03WGWxDzRM9+ogZqySwr7GKh1:WqXMaixYDzi9+oe7r

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1904	BatchFiles.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1904	2356	BatchFiles.exe	99
PID 2356 wrote to memory of 1904	2356	BatchFiles.exe	99
PID 2356 wrote to memory of 1904	2356	BatchFiles.exe	99

C:\Users\Admin\AppData\Local\Temp\BatchFiles.exe
"C:\Users\Admin\AppData\Local\Temp\BatchFiles.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\is-87ELU.tmp\BatchFiles.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-87ELU.tmp\BatchFiles.tmp" /SL5="$A0170,1980055,54272,C:\Users\Admin\AppData\Local\Temp\BatchFiles.exe"
  2⤵
  - Executes dropped EXE
  PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5240 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:1460

C:\Users\Admin\AppData\Local\Temp\is-87ELU.tmp\BatchFiles.tmp

Filesize
694KB

MD5
f0ccfb46f867443700d31c969bdcf552

SHA1
f2474d5d7a906de3bc3381ca79bb1ea60f0d6697

SHA256
54bb849d30567d5f10ac359f8b503732a3fcd76ad7cc72007eab843b784367bb

SHA512
71c7de53d1db03f1149c3e82fd92842cbd284d17c981267b20290f8d54baf2b578f7830f64eb5308c82cf4aff4f1937586624c2769da74a463c8d4ebdcbe45ee

Download Submit
memory/1904-9-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/1904-11-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1904-12-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2356-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2356-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2356-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2356-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2356-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2356-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download