129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2

Analysis

max time kernel
90s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 15:05

Target

zapret-winws/1.cmd
Size

148B
MD5

b5ec55dd0d83a7822d1262078f2c1a55
SHA1

d53a59d2722f617f4a18625d3600f8befa66104c
SHA256

dcfefd4ce292e764604f461c00b0db5b1aed5f994823ef25fd5faa8663b6970f
SHA512

4a24bfc6349bdaf5ffbc95f007dd899480b517cced8a129192f8cd8d83b1373348bd27d0384beb7b46cf245dfc150c043d894c457ed6b1fafdf9d19849e96708

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2852-0-0x000007FEF61C0000-0x000007FEF64D2000-memory.dmp	upx
behavioral1/memory/2852-5-0x000007FEF61C0000-0x000007FEF64D2000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2852	2464	cmd.exe	31
PID 2464 wrote to memory of 2852	2464	cmd.exe	31
PID 2464 wrote to memory of 2852	2464	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\1.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe" --wf-udp=50000-65535 --filter-udp=50000-65535 --dpi-desync=fake,tamper --dpi-desync-any-protocol
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2852

memory/2852-0-0x000007FEF61C0000-0x000007FEF64D2000-memory.dmp

Filesize
3.1MB

Download
memory/2852-1-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/2852-5-0x000007FEF61C0000-0x000007FEF64D2000-memory.dmp

Filesize
3.1MB

Download
memory/2852-4-0x0000000062800000-0x0000000062813000-memory.dmp

Filesize
76KB

Download
memory/2852-2-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download