660effaf33e85bc19be61ab5cfa64fc187bc9902317c292770a5a18683b000ed

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 00:28

Target

core.bat
Size

186B
MD5

c69400616b3e6ff4875c8322f7ef0ed1
SHA1

da112c52c72f50a64ff4aabcec17f5f3c16c5148
SHA256

d6e0649ba38b6acbd75fd06d34cbe332220c4b6d7d774afceaa2816a6bd8ba68
SHA512

2c61b0c6578eb8306da959ad329723902469a07418b2ea80a93f330f59ce757c0d660b7ae915d6d14735e6557b324668c6fd1af9cc0da866cc139fc35e5df0f9

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2348	rundll32.exe
1528	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2348	2508	cmd.exe	31
PID 2508 wrote to memory of 2348	2508	cmd.exe	31
PID 2508 wrote to memory of 2348	2508	cmd.exe	31
PID 2508 wrote to memory of 1528	2508	cmd.exe	32
PID 2508 wrote to memory of 1528	2508	cmd.exe	32
PID 2508 wrote to memory of 1528	2508	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vessel-64.dat,DllMain /i="license.dat"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vessel-64.dat,update /i="license.dat"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1528

memory/1528-8-0x000007FEF54B5000-0x000007FEF5738000-memory.dmp

Filesize
2.5MB

Download
memory/1528-13-0x0000000077240000-0x0000000077242000-memory.dmp

Filesize
8KB

Download
memory/1528-14-0x000007FEF54B5000-0x000007FEF5738000-memory.dmp

Filesize
2.5MB

Download
memory/2348-7-0x000007FEF5945000-0x000007FEF5BC8000-memory.dmp

Filesize
2.5MB

Download
memory/2348-6-0x0000000077240000-0x0000000077242000-memory.dmp

Filesize
8KB

Download
memory/2348-4-0x0000000077240000-0x0000000077242000-memory.dmp

Filesize
8KB

Download
memory/2348-2-0x0000000077240000-0x0000000077242000-memory.dmp

Filesize
8KB

Download