17ac44b604ad3450348a5769a851c16abc3b256ea8c5c4e64bb64ac3657b403f

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/11/2024, 22:54

Target
1_russia_blacklist_YOUTUBE_ALT.cmd
Size 427B
Sample241109-2vqljstja1
SHA256 ffd2fc0fefca6cff2525c92ce5a7e6109a4a9e50756de275b85fbd86bec07760
MD5 74a8e80f39adfd1ff8836a5c05254f37
SHA1 eb6fdfce93b5d3c2bad5724c97584c0676803bae
SHA512 1b74775be3d4d5f14874cf3bce0a45d937d972a7d5f7bd9f84b674baae592e3905ca1295461c723846b42c38e17c0dee2c17334d6f4261a8af1aab0077fa6a83
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2468	2480	cmd.exe	32
PID 2480 wrote to memory of 2468	2480	cmd.exe	32
PID 2480 wrote to memory of 2468	2480	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\1_russia_blacklist_YOUTUBE_ALT.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 -e1 -q --fake-gen 5 --fake-from-hex 160301FFFF01FFFFFF0303594F5552204144564552544953454D454E542048455245202D202431302F6D6F000000000009000000050003000000 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txt
  2⤵
  PID:2468

memory/2468-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2468-0-0x000000013F6D0000-0x000000013F6F2000-memory.dmp

Download

memory/2468-2-0x000000013F6D0000-0x000000013F6F2000-memory.dmp

Download