87459ec9853124a600bd2976f33d26ac5ec53f7c7b305858ee4502bef69104f1

Analysis

max time kernel
133s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 19:53

Target

EA DLC Unlocker v2/setup.bat
Size

14KB
MD5

313b65ba5a36ba99e5f05f8e060a6882
SHA1

b38eb49f908e823ef820ba4fa0f0877c3c73b324
SHA256

bdf9d9052c1beb9fab9d5e4301c7f0b63e1c3737b7e3feedaa5c3ab7a3d247d6
SHA512

00a16e970b318e67e296b1cc1067323566c3eb0e115d31bf96f60705b94458860e7619878882f708dfffb4951111a75754b46fbf93aef70333d0e187d1161336
SSDEEP

192:Q+xaM15cr4EV4cLEOqqFir1/C4BxoZIR/j/0G:r9MhqLBpf

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4844	4556	cmd.exe	83
PID 4556 wrote to memory of 4844	4556	cmd.exe	83
PID 4556 wrote to memory of 3208	4556	cmd.exe	84
PID 4556 wrote to memory of 3208	4556	cmd.exe	84
PID 4556 wrote to memory of 2348	4556	cmd.exe	85
PID 4556 wrote to memory of 2348	4556	cmd.exe	85
PID 4556 wrote to memory of 4184	4556	cmd.exe	86
PID 4556 wrote to memory of 4184	4556	cmd.exe	86
PID 4556 wrote to memory of 3904	4556	cmd.exe	87
PID 4556 wrote to memory of 3904	4556	cmd.exe	87
PID 4556 wrote to memory of 3916	4556	cmd.exe	88
PID 4556 wrote to memory of 3916	4556	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo marco "
  2⤵
  PID:4844
- C:\Windows\System32\findstr.exe
  findstr /C:"polo"
  2⤵
  PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo marco "
  2⤵
  PID:2348
- C:\Windows\System32\findstr.exe
  findstr /V /C:"polo"
  2⤵
  PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\" "
  2⤵
  PID:3904
- C:\Windows\System32\findstr.exe
  findstr /V /C:"C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3916