ff9c244cef030284f53f8fcd718410956061d095c562281b7b597af594d0909f

Analysis

max time kernel
26s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/03/2023, 19:56

Target

BetterVjoy/! Driver Uninstall (Run as Admin).bat
Size

375B
MD5

3f57d7460905eacb9f7c3296a1df618a
SHA1

8b86e83bba02268ebbb663dfffb3ae0d98825b8f
SHA256

64c58ddfda8075ab7a41c0e21250fc571b3a273b636b4d8f73ac76e18920bf65
SHA512

676a9e02a3821b952e36c7329e1e15eb11ea6fa31637c6fa0fe48459d61606230c9bfc106f9af8b72bb257696a988d3262550ef30a58c7e72f28c2373d8e9c98

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1704	1468	cmd.exe	28
PID 1468 wrote to memory of 1704	1468	cmd.exe	28
PID 1468 wrote to memory of 1704	1468	cmd.exe	28
PID 1468 wrote to memory of 764	1468	cmd.exe	29
PID 1468 wrote to memory of 764	1468	cmd.exe	29
PID 1468 wrote to memory of 764	1468	cmd.exe	29
PID 1468 wrote to memory of 1504	1468	cmd.exe	30
PID 1468 wrote to memory of 1504	1468	cmd.exe	30
PID 1468 wrote to memory of 1504	1468	cmd.exe	30
PID 1468 wrote to memory of 1688	1468	cmd.exe	31
PID 1468 wrote to memory of 1688	1468	cmd.exe	31
PID 1468 wrote to memory of 1688	1468	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\BetterVjoy\! Driver Uninstall (Run as Admin).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\BetterVjoy\Drivers\devcon.exe
  devcon.exe remove Root\ViGEmBus
  2⤵
  PID:1704
- C:\Users\Admin\AppData\Local\Temp\BetterVjoy\Drivers\HidCerberus.Srv\HidCerberus.Srv.exe
  HidCerberus.Srv.exe uninstall
  2⤵
  PID:764
- C:\Users\Admin\AppData\Local\Temp\BetterVjoy\Drivers\devcon.exe
  devcon.exe remove Root\HidGuardian
  2⤵
  PID:1504
- C:\Users\Admin\AppData\Local\Temp\BetterVjoy\Drivers\devcon.exe
  devcon.exe classfilter HIDClass upper !HidGuardian
  2⤵
  PID:1688

memory/764-54-0x0000000000C70000-0x0000000000D08000-memory.dmp

Filesize
608KB

Download
memory/764-55-0x00000000002D0000-0x0000000000304000-memory.dmp

Filesize
208KB

Download
memory/764-56-0x00000000004B0000-0x0000000000592000-memory.dmp

Filesize
904KB

Download
memory/764-57-0x000000001A9B0000-0x000000001AA30000-memory.dmp

Filesize
512KB

Download
memory/764-58-0x000000001A9B0000-0x000000001AA30000-memory.dmp

Filesize
512KB

Download