f686f33c05d63eb019164da669495fbb53c181d4d39603d03018afd883a923e9

Analysis

max time kernel
142s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 22:34

Target

example.bat
Size

375B
MD5

0b82eb82a679264f15865626b010aa8d
SHA1

7f49e3373c2afab3bd2d335d370bd5da4a19fe43
SHA256

de92d031325ae247e216b6c0531575e35eda65c872dab8ac0643c80de459edba
SHA512

9c197553abe70a95dbaa1d53a38603989a408245172acc23659b9351b39516bf57a78876863904798c22496247949bb6d117ae68f2d41fdffc2053dc4d16ac6f

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	Web2Pic_Pro.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2392	Web2Pic_Pro.exe
2392	Web2Pic_Pro.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 2392	4268	cmd.exe	83
PID 4268 wrote to memory of 2392	4268	cmd.exe	83
PID 4268 wrote to memory of 2392	4268	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\example.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\Web2Pic_Pro.exe
  web2pic_pro.exe /u=http://www.google.com /p="d:\my pages\google.png"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2392

C:\Windows\win.ini

Filesize
314B

MD5
6eb677db7baa05fdbbefb18bb6770d5d

SHA1
1abb44ff571ca6ab54b8f11d502fb315e2575916

SHA256
5dc8a640f05b059d5125c1b6a416b56bbc4b0f3d386c16c6a1a991577d92ba04

SHA512
a23c3653ec8649600ca4adff4b69e35ca650ea991d109bf05559d495076dd3df5f42fb563a90dadcebf63c1c1670af05614ad8c00020c40217d607b23a2db3e7

Download Submit
C:\Windows\win.ini

Filesize
314B

MD5
b32dfababcc7109f531ea6a8d2df5a0a

SHA1
23ef3b500ccbe5c1863107b6c03548091fe959c2

SHA256
9a7bd44d27bc48a6b15beddbcf8bf7ecb4e49dcf7faac1a702974ae71330908a

SHA512
d4c2ad56d43c9437c79c110e2b4be645760c8c151f491fef7b01f9e9cdceb41d2eca224a446eac0366dee5d2c5589178032ec4ce84242b28d1bd1353e2dabbf8

Download Submit
memory/2392-0-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/2392-31-0x0000000000400000-0x00000000008D9000-memory.dmp

Filesize
4.8MB

Download
memory/2392-33-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download