17ac44b604ad3450348a5769a851c16abc3b256ea8c5c4e64bb64ac3657b403f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/11/2024, 22:54

Target
1_russia_blacklist_YOUTUBE.cmd
Size 420B
Sample241109-2vqljstja1
SHA256 2712d7700e2f3217e826412a5a773487f08a41451849722ffaa08841b8684496
MD5 55e68f566514148bcf844524b4e99041
SHA1 8b1d5715cf9a1513b6db9d74270b20266c047c9e
SHA512 075cd6dbe158028bbc315591c69a9554c80dd50c510457f802e5f4f1b34104eefb1113f165061c21c07fecb70bd0d8e7170a97aa3e08107a98eead2b2f7473f0
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2324	2092	cmd.exe	31
PID 2092 wrote to memory of 2324	2092	cmd.exe	31
PID 2092 wrote to memory of 2324	2092	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\1_russia_blacklist_YOUTUBE.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe -9 --fake-gen 5 --fake-from-hex 160301FFFF01FFFFFF0303594F5552204144564552544953454D454E542048455245202D202431302F6D6F000000000009000000050003000000 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txt
  2⤵
  PID:2324

memory/2324-0-0x000000013F440000-0x000000013F462000-memory.dmp

Download

memory/2324-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2324-4-0x000000013F440000-0x000000013F462000-memory.dmp

Download