f686f33c05d63eb019164da669495fbb53c181d4d39603d03018afd883a923e9

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 22:34

Target

example.bat
Size

375B
MD5

0b82eb82a679264f15865626b010aa8d
SHA1

7f49e3373c2afab3bd2d335d370bd5da4a19fe43
SHA256

de92d031325ae247e216b6c0531575e35eda65c872dab8ac0643c80de459edba
SHA512

9c197553abe70a95dbaa1d53a38603989a408245172acc23659b9351b39516bf57a78876863904798c22496247949bb6d117ae68f2d41fdffc2053dc4d16ac6f

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	Web2Pic_Pro.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2968	Web2Pic_Pro.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2968	Web2Pic_Pro.exe
2968	Web2Pic_Pro.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2968	1644	cmd.exe	31
PID 1644 wrote to memory of 2968	1644	cmd.exe	31
PID 1644 wrote to memory of 2968	1644	cmd.exe	31
PID 1644 wrote to memory of 2968	1644	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\example.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\Web2Pic_Pro.exe
  web2pic_pro.exe /u=http://www.google.com /p="d:\my pages\google.png"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:2968

C:\Windows\win.ini

Filesize
700B

MD5
5c9cea5ba9dc24f362c3a0a96e276c6d

SHA1
ed18a9d2a1e4570e45586461a167fb9962dcde02

SHA256
2901dbbb868102cd5002a56b950e42397979d9d68bbc470543063db039551116

SHA512
1f496e8665528011fd34d907c50f9e9dbe6a147f00f355ade52734eecff57d94f0659722eba76ca398321d8f1068eacadec30308333beec8146617ec5c7d8887

Download Submit
memory/2968-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2968-31-0x0000000000400000-0x00000000008D9000-memory.dmp

Filesize
4.8MB

Download
memory/2968-33-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download