ff8c11f132ed73ea6cbdf3dae4f8d02886392d66c1adfef3ad52f5a1f5022cb5

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 15:18

Target

Command Line Examples.cmd
Size

379B
MD5

ea34aeffb40b76122edec5f028441bc4
SHA1

72e9642ed07f2941e590af9634c740a7073b559d
SHA256

b6f7616f406f074dc9e75f28df169444f370ba6605bbcff97a165dd799f29126
SHA512

009f1c32511a4410ae33a1782a917137bd893d99daa3c6f32b3b7dbf1c30d29eea56b2dd3bb1709292670d317459e514501bd41b8c3334498d16fe21334add91

Score

1^/10

Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1660	2180	cmd.exe	29
PID 2180 wrote to memory of 1660	2180	cmd.exe	29
PID 2180 wrote to memory of 1660	2180	cmd.exe	29
PID 2180 wrote to memory of 1660	2180	cmd.exe	29
PID 2180 wrote to memory of 2116	2180	cmd.exe	30
PID 2180 wrote to memory of 2116	2180	cmd.exe	30
PID 2180 wrote to memory of 2116	2180	cmd.exe	30
PID 2180 wrote to memory of 2116	2180	cmd.exe	30
PID 2180 wrote to memory of 2100	2180	cmd.exe	31
PID 2180 wrote to memory of 2100	2180	cmd.exe	31
PID 2180 wrote to memory of 2100	2180	cmd.exe	31
PID 2180 wrote to memory of 2100	2180	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Command Line Examples.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\3dRipperPro.exe
  3dRipperPro.exe 347cae9f87104374bc3ac554d9d3fd6e
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\3dRipperPro.exe
  3dRipperPro.exe 450fb6a057fd4ce4a416c714a5676fdf textures
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\3dRipperPro.exe
  3dRipperPro.exe 450fb6a057fd4ce4a416c714a5676fdf batch
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:2100