a44e75344f1f7dd3d3e4566447686dbd9cca6e50beeea3f78e3069d12fa55d76

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:05

Target
dont run this.bat
Size 679B
Sample240603-n88sdsfa86
SHA256 a44e75344f1f7dd3d3e4566447686dbd9cca6e50beeea3f78e3069d12fa55d76
MD5 9d33bb64a41396987b2a7e92aa5be2df
SHA1 3d5bc461901dc123465c25943ffdb7543f76635e
SHA512 df7fa6751eaf46fe10c49ed07f4457cceccd5af43ac8eaee9c6d2fa6b733538fc744f9e8d55a80ceac567c71114621197fcdc60b4ba582415760d5b17c4a18b1
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 6 IoCs

evasion

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2324	1684	cmd.exe	83
PID 1684 wrote to memory of 2324	1684	cmd.exe	83
PID 1684 wrote to memory of 3192	1684	cmd.exe	89
PID 1684 wrote to memory of 3192	1684	cmd.exe	89
PID 1684 wrote to memory of 4468	1684	cmd.exe	91
PID 1684 wrote to memory of 4468	1684	cmd.exe	91
PID 1684 wrote to memory of 3648	1684	cmd.exe	94
PID 1684 wrote to memory of 3648	1684	cmd.exe	94
PID 1684 wrote to memory of 3584	1684	cmd.exe	95
PID 1684 wrote to memory of 3584	1684	cmd.exe	95
PID 1684 wrote to memory of 1364	1684	cmd.exe	97
PID 1684 wrote to memory of 1364	1684	cmd.exe	97
PID 1684 wrote to memory of 4792	1684	cmd.exe	98
PID 1684 wrote to memory of 4792	1684	cmd.exe	98
PID 1684 wrote to memory of 776	1684	cmd.exe	100
PID 1684 wrote to memory of 776	1684	cmd.exe	100
PID 1684 wrote to memory of 4220	1684	cmd.exe	101
PID 1684 wrote to memory of 4220	1684	cmd.exe	101
PID 1684 wrote to memory of 2284	1684	cmd.exe	104
PID 1684 wrote to memory of 2284	1684	cmd.exe	104
PID 1684 wrote to memory of 2784	1684	cmd.exe	105
PID 1684 wrote to memory of 2784	1684	cmd.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dont run this.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:2324
- C:\Windows\system32\cmd.exe
  cmd /k "call :spam"
  2⤵
  PID:3192
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4468
- C:\Windows\system32\cmd.exe
  cmd /k "call :spam"
  2⤵
  PID:3648
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3584
- C:\Windows\system32\cmd.exe
  cmd /k "call :spam"
  2⤵
  PID:1364
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4792
- C:\Windows\system32\cmd.exe
  cmd /k "call :spam"
  2⤵
  PID:776
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4220
- C:\Windows\system32\cmd.exe
  cmd /k "call :spam"
  2⤵
  PID:2284
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2784

IMWATCHING_YOU20850.txt

Path C:\Users\Admin\Desktop\IMWATCHING_YOU20850.txt
Size 4KB
SHA256 b75515e29da738d2b2f5273bee71e0f53afb605d1f06d27aca56b6e28c8cce99
MD5 d492c3a6ee82ba075dae805af3b2562c
SHA1 4ada1abf7552aa8ed1d53a5dac72343e634ab5fa
SHA512 5564b7e682ff0d9d93043b63b54272d5802089f57cc24d4dd99cc7365fd1cc46bc787bd37d5dc4ad7da096c02c6c3e7c3082aa8a018d73abfd258b6feb195edc
SSDEEP 3:jIFS5QS75QS75QS75QS75QS75QS75QS75QS75QS75QS75QS75QS75QS75QS75QSj:X
MD5 SHA1 SHA512 SSDEEP

Submit Download