17ac44b604ad3450348a5769a851c16abc3b256ea8c5c4e64bb64ac3657b403f

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/11/2024, 22:54

Target
2_any_country.cmd
Size 204B
Sample241109-2vqljstja1
SHA256 17a3d7b8b1e1340f67d3687ce9162199c0a25025941d23954880808403487d07
MD5 72103c58f2ed536ebc07e19fd00fa2f0
SHA1 cd37e3bfdc4dbeecfd945561b8538e328dcfe2f9
SHA512 4270dfb825f03d41d5911db8cef7de43c58a0401d84bd72e047da6b9fc6753789c070c9fd61bb0145f70b47026ba70d9d18612fefd1314436998adb354de815b
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2696	1728	cmd.exe	31
PID 1728 wrote to memory of 2696	1728	cmd.exe	31
PID 1728 wrote to memory of 2696	1728	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\2_any_country.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe -9
  2⤵
  PID:2696

memory/2696-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2696-0-0x000000013FEE0000-0x000000013FF02000-memory.dmp

Download

memory/2696-4-0x000000013FEE0000-0x000000013FF02000-memory.dmp

Download