37f96b32d050dadcc930a639eba68e1ccd57ed5c04a5f77dfca908f01905a4c5

Analysis

max time kernel
22s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 09:02

Target

goodbyedpi-0.2.3rc3-2/1_russia_blacklist_YOUTUBE_ALT.cmd
Size

427B
MD5

74a8e80f39adfd1ff8836a5c05254f37
SHA1

eb6fdfce93b5d3c2bad5724c97584c0676803bae
SHA256

ffd2fc0fefca6cff2525c92ce5a7e6109a4a9e50756de275b85fbd86bec07760
SHA512

1b74775be3d4d5f14874cf3bce0a45d937d972a7d5f7bd9f84b674baae592e3905ca1295461c723846b42c38e17c0dee2c17334d6f4261a8af1aab0077fa6a83

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2604	3060	cmd.exe	30
PID 3060 wrote to memory of 2604	3060	cmd.exe	30
PID 3060 wrote to memory of 2604	3060	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.3rc3-2\1_russia_blacklist_YOUTUBE_ALT.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.3rc3-2\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 -e1 -q --fake-gen 5 --fake-from-hex 160301FFFF01FFFFFF0303594F5552204144564552544953454D454E542048455245202D202431302F6D6F000000000009000000050003000000 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txt
  2⤵
  PID:2604

memory/2604-0-0x000000013F180000-0x000000013F1A2000-memory.dmp

Filesize
136KB

Download
memory/2604-1-0x0000000062800000-0x0000000062813000-memory.dmp

Filesize
76KB

Download
memory/2604-4-0x000000013F180000-0x000000013F1A2000-memory.dmp

Filesize
136KB

Download