17ac44b604ad3450348a5769a851c16abc3b256ea8c5c4e64bb64ac3657b403f

Analysis

max time kernel
22s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09/11/2024, 22:54

Target
1_russia_blacklist.cmd
Size 274B
Sample241109-2vqljstja1
SHA256 69c8b67fafbca446ce5302e97f9947191ecb84d2a51eae61d4955dc3e2147da0
MD5 76763259e528cd27e998fb4c665c2b78
SHA1 f2b6e15dca04c54ace2aefc4bc72656dc7550cab
SHA512 69d35fb64ab4cee901b7ecc9baac437cd4dd5e3feb5b006a0fa8c3d52fce8ac9eea5ee68a6dcea01f5386966ac135e85bfba8fc8eecec5d8c70212e795d0dd76
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 3048	2496	cmd.exe	31
PID 2496 wrote to memory of 3048	2496	cmd.exe	31
PID 2496 wrote to memory of 3048	2496	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\1_russia_blacklist.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe -9 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txt
  2⤵
  PID:3048

memory/3048-0-0x000000013FBD0000-0x000000013FBF2000-memory.dmp

Download

memory/3048-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3048-4-0x000000013FBD0000-0x000000013FBF2000-memory.dmp

Download