87459ec9853124a600bd2976f33d26ac5ec53f7c7b305858ee4502bef69104f1

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 19:53

Target

EA DLC Unlocker v2/setup.bat
Size

14KB
MD5

313b65ba5a36ba99e5f05f8e060a6882
SHA1

b38eb49f908e823ef820ba4fa0f0877c3c73b324
SHA256

bdf9d9052c1beb9fab9d5e4301c7f0b63e1c3737b7e3feedaa5c3ab7a3d247d6
SHA512

00a16e970b318e67e296b1cc1067323566c3eb0e115d31bf96f60705b94458860e7619878882f708dfffb4951111a75754b46fbf93aef70333d0e187d1161336
SSDEEP

192:Q+xaM15cr4EV4cLEOqqFir1/C4BxoZIR/j/0G:r9MhqLBpf

Score

1^/10

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2204	1336	cmd.exe	29
PID 1336 wrote to memory of 2204	1336	cmd.exe	29
PID 1336 wrote to memory of 2204	1336	cmd.exe	29
PID 1336 wrote to memory of 2208	1336	cmd.exe	30
PID 1336 wrote to memory of 2208	1336	cmd.exe	30
PID 1336 wrote to memory of 2208	1336	cmd.exe	30
PID 1336 wrote to memory of 2200	1336	cmd.exe	31
PID 1336 wrote to memory of 2200	1336	cmd.exe	31
PID 1336 wrote to memory of 2200	1336	cmd.exe	31
PID 1336 wrote to memory of 2636	1336	cmd.exe	32
PID 1336 wrote to memory of 2636	1336	cmd.exe	32
PID 1336 wrote to memory of 2636	1336	cmd.exe	32
PID 1336 wrote to memory of 2884	1336	cmd.exe	33
PID 1336 wrote to memory of 2884	1336	cmd.exe	33
PID 1336 wrote to memory of 2884	1336	cmd.exe	33
PID 1336 wrote to memory of 2156	1336	cmd.exe	34
PID 1336 wrote to memory of 2156	1336	cmd.exe	34
PID 1336 wrote to memory of 2156	1336	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo marco "
  2⤵
  PID:2204
- C:\Windows\System32\findstr.exe
  findstr /C:"polo"
  2⤵
  PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo marco "
  2⤵
  PID:2200
- C:\Windows\System32\findstr.exe
  findstr /V /C:"polo"
  2⤵
  PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\" "
  2⤵
  PID:2884
- C:\Windows\System32\findstr.exe
  findstr /V /C:"C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2156