IOC Report
onedrive.bat.exe

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\onedrive.bat.exe

C:\Users\user\Desktop\onedrive.bat.exe

Details

Is windows:	false
Is dropped:	false
PID:	2948
Target ID:	1
Parent PID:	1860
Name:	onedrive.bat.exe
Path:	C:\Users\user\Desktop\onedrive.bat.exe
Commandline:	C:\Users\user\Desktop\onedrive.bat.exe
Size:	433152
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Time:	00:07:12
Date:	19/03/2023
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xcb0000
Modulesize:	446464
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

Memdumps

Base Address

Regiontype

Protect

Malicious

D14000

unkown

page readonly

Details

Name:	00000001.00000000.890072128.0000000000D14000.00000002.00000001.01000000.00000003.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	D14000
Size:	36864

Signature Hits	Behavior Group	Mitre Attack
Sample file is different than original file name gathered from version info	System Summary

CC2000

unkown

page readonly

CC1000

unkown

page write copy

CB0000

unkown

page readonly

CB1000

unkown

page execute read