76ab0e05ba20883efc507e3aa6c4eac185b33616ba95ae30115db9b59fe54b62

Analysis

max time kernel
82s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2023, 14:47

Target

VS.bat
Size

2KB
MD5

0466123099d2b9012a530e50559e7944
SHA1

1ab78c20ef8ad5c1a26bd2be3514e5ca607c9efe
SHA256

76ab0e05ba20883efc507e3aa6c4eac185b33616ba95ae30115db9b59fe54b62
SHA512

7ac61033281ef5bef5b16443a206924f3996679db53dda8ba65cb28acf62420b8b83ed1398a43db2267fe9547640d2b8f4e871ee4f4f83146bb14e1de517d40c

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
112	timeout.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 3100	4232	cmd.exe	89
PID 4232 wrote to memory of 3100	4232	cmd.exe	89
PID 3100 wrote to memory of 3328	3100	cmd.exe	90
PID 3100 wrote to memory of 3328	3100	cmd.exe	90
PID 4232 wrote to memory of 4412	4232	cmd.exe	91
PID 4232 wrote to memory of 4412	4232	cmd.exe	91
PID 4412 wrote to memory of 4436	4412	cmd.exe	92
PID 4412 wrote to memory of 4436	4412	cmd.exe	92
PID 4232 wrote to memory of 1780	4232	cmd.exe	93
PID 4232 wrote to memory of 1780	4232	cmd.exe	93
PID 4232 wrote to memory of 112	4232	cmd.exe	94
PID 4232 wrote to memory of 112	4232	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VS.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG QUERY "HKCU\SOFTWARE\DownloadManager" /v "VScannerProgram" 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\reg.exe
    REG QUERY "HKCU\SOFTWARE\DownloadManager" /v "VScannerProgram"
    3⤵
    PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG QUERY "HKCU\Software\VScan" /v "LastTimeOfStart" 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\system32\reg.exe
    REG QUERY "HKCU\Software\VScan" /v "LastTimeOfStart"
    3⤵
    PID:4436
- C:\Windows\system32\reg.exe
  REG ADD "HKCU\Software\VScan" /v "LastTimeOfStart" /t REG_SZ /d 1 /f
  2⤵
  PID:1780
- C:\Windows\system32\timeout.exe
  TIMEOUT /T 300
  2⤵
  - Delays execution with timeout.exe
  PID:112