50a6f49c25dd6b918ac78979d277094e7cb74a039605c5a8f90f944a8eb80f4b

Analysis

max time kernel
17s
max time network
22s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
11/10/2024, 20:58

Target

HhhAAzzZZ Hub [Beta].bat
Size

61KB
MD5

e4c386413bb85d95259ed86adc2feffd
SHA1

d6232da314f344a66d9b27b932910c751d7bb9cc
SHA256

50a6f49c25dd6b918ac78979d277094e7cb74a039605c5a8f90f944a8eb80f4b
SHA512

355c0f1580b28fd4144a11c8397b3ec8da446b7814435496ef3de206a268c66e13e4221fead262ac9b00c73a957a7c0fdc95214078f01020d9131c28b5b4f891
SSDEEP

192:fYEP3+AHnWBHX2aXvGAttGbD5D3seaODVI2y3A1SFjeh7QASzJ/eoDS8ngiqHjsv:H3+Ag32QGp3sxr3AAubLGuuH8z9SH

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 400	2376	cmd.exe	72
PID 2376 wrote to memory of 400	2376	cmd.exe	72
PID 2376 wrote to memory of 1136	2376	cmd.exe	73
PID 2376 wrote to memory of 1136	2376	cmd.exe	73
PID 2376 wrote to memory of 532	2376	cmd.exe	74
PID 2376 wrote to memory of 532	2376	cmd.exe	74

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HhhAAzzZZ Hub [Beta].bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\certutil.exe
  certutil -hashfile C:\Users\Admin\AppData\Local\Temp\ip_clean.txt SHA256
  2⤵
  PID:400
- C:\Windows\system32\findstr.exe
  findstr /v "hash"
  2⤵
  PID:1136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s https://hehehe.nuked.asia/p/raw/p3ap31nzyzbcyi0ht
  2⤵
  PID:532

C:\Users\Admin\AppData\Local\Temp\ip_clean.txt

Filesize
14B

MD5
ce585c6ba32ac17652d2345118536f9c

SHA1
be0e41b3690c42e4c0cdb53d53fc544fb46b758d

SHA256
589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3

SHA512
d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752

Download Submit