a78f41c5a6b3750c18f5b3a2b837f7a48b789eb6bbc681367d1b9c23892202fb

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 14:40

Target

!inject.bat
Size

96B
MD5

90b6e06f279f201562460d3b38bd8b0a
SHA1

9b2f3b4b7bf08a1a897b30ab787a9b1a7e9dfdf1
SHA256

ea426d508f92d25c545dc3f5f03a80db60e88a4ba11ad40d93e6c43bb64dac1f
SHA512

09a7ad9518e48117f542097697795d0d1c04c2a02efe28060b8beed49d2386325045c9d54137d823cd107a1101c33d8bd27e6a6f4e832ab27132038659d80cde

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2328	smi.exe
2328	smi.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	smi.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2328	2388	cmd.exe	30
PID 2388 wrote to memory of 2328	2388	cmd.exe	30
PID 2388 wrote to memory of 2328	2388	cmd.exe	30
PID 2328 wrote to memory of 2868	2328	smi.exe	31
PID 2328 wrote to memory of 2868	2328	smi.exe	31
PID 2328 wrote to memory of 2868	2328	smi.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\!inject.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\smi.exe
  smi.exe inject -p "Lethal Company" -a ProjectApparatus.dll -n ProjectApparatus -c Loader -m Init
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2328 -s 652
    3⤵
    PID:2868

memory/2328-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

Filesize
4KB

Download
memory/2328-1-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download
memory/2328-2-0x0000000000170000-0x000000000017C000-memory.dmp

Filesize
48KB

Download
memory/2328-4-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

Filesize
4KB

Download