File name: | forkbomb.bat |
Full analysis: | https://app.any.run/tasks/89ab36e0-9424-4821-9f9e-8b87e5e5e1b6 |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 15:48:53 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with CRLF line terminators |
MD5: | AE96E769138DD92870B7A3332F3ABD51 |
SHA1: | 4D2DFF80A8F283552094D50C5ABB5F6F412AE6FF |
SHA256: | 20FA2C6FD88E29B3E7B57D123BDA3B59EFA4F6B56A98A5B7C9EE1C818B25E456 |
SSDEEP: | 3:+ys6V:+Q |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3492 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\forkbomb.bat" " | C:\Windows\system32\cmd.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2504 | C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\admin\AppData\Local\Temp\forkbomb.bat" " | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1252 | C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\admin\AppData\Local\Temp\forkbomb.bat"" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3996 | C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\admin\AppData\Local\Temp\forkbomb.bat" " | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3848 | C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\admin\AppData\Local\Temp\forkbomb.bat" " | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
4052 | C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\admin\AppData\Local\Temp\forkbomb.bat"" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
4012 | C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\admin\AppData\Local\Temp\forkbomb.bat"" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2228 | C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\admin\AppData\Local\Temp\forkbomb.bat" " | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2368 | C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\admin\AppData\Local\Temp\forkbomb.bat"" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2400 | C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\admin\AppData\Local\Temp\forkbomb.bat" " | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
|