IOC Report
init_DB.exe

loading gif

Files

File Path
Type
Category
Malicious
init_DB.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\1413.tmp\1414.tmp\1415.bat
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\init_DB.exe
"C:\Users\user\Desktop\init_DB.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\1413.tmp\1414.tmp\1415.bat C:\Users\user\Desktop\init_DB.exe"

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page readonly
5B0000
heap
page read and write
19D000
stack
page read and write
5EE000
heap
page read and write
413000
unkown
page readonly
8DF000
stack
page read and write
20C7000
heap
page read and write
430000
heap
page read and write
413000
unkown
page readonly
417000
unkown
page write copy
2140000
heap
page read and write
1D0000
heap
page read and write
20B0000
heap
page read and write
419000
unkown
page readonly
55E000
stack
page read and write
5EA000
heap
page read and write
400000
unkown
page readonly
20C0000
heap
page read and write
401000
unkown
page execute read
5E0000
heap
page read and write
510000
heap
page read and write
20C4000
heap
page read and write
417000
unkown
page read and write
401000
unkown
page execute read
A80000
heap
page read and write
2260000
heap
page read and write
59E000
stack
page read and write
419000
unkown
page readonly
9B000
stack
page read and write
7DF000
stack
page read and write
There are 20 hidden memdumps, click here to show them.