17ac44b604ad3450348a5769a851c16abc3b256ea8c5c4e64bb64ac3657b403f

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:54

Target
1_russia_blacklist.cmd
Size 274B
Sample241109-2vqljstja1
SHA256 69c8b67fafbca446ce5302e97f9947191ecb84d2a51eae61d4955dc3e2147da0
MD5 76763259e528cd27e998fb4c665c2b78
SHA1 f2b6e15dca04c54ace2aefc4bc72656dc7550cab
SHA512 69d35fb64ab4cee901b7ecc9baac437cd4dd5e3feb5b006a0fa8c3d52fce8ac9eea5ee68a6dcea01f5386966ac135e85bfba8fc8eecec5d8c70212e795d0dd76
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 4880	976	cmd.exe	84
PID 976 wrote to memory of 4880	976	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1_russia_blacklist.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe -9 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txt
  2⤵
  PID:4880

memory/4880-0-0x00007FF66AFC0000-0x00007FF66AFE2000-memory.dmp

Download

memory/4880-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4880-2-0x00007FF66AFC0000-0x00007FF66AFE2000-memory.dmp

Download