d010f7ff96be9074eca1c773c700029ee1cecc0a0c8242dfacd4702d1ca7bdd0

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 14:15

Target

Pack_Mouse_2.0/MarkC_MouseFix/Disable_WelcomeScreen+Login_Accel.cmd
Size

1KB
MD5

368530b45ff37e17af8900c8d18a3c1f
SHA1

4bab5f0d0225e935f6fce638d8c254aeeeee21e5
SHA256

e6c65f0f4645d4c256fd081b09f4dc0cafcdf48ee12a3b32190887dd702d4cb0
SHA512

f2933be3b535f1915041b885ca05d18f271ed57aa6928cdd9d33ea3b2c11d6a583a0959947976015179a6c31261ef421c7c2a74c8fa7a1fe22dbec5d1a5d8004

Score

1^/10

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	reg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSpeed = "0"	reg.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2676	3288	cmd.exe	86
PID 3288 wrote to memory of 2676	3288	cmd.exe	86
PID 2676 wrote to memory of 2628	2676	cmd.exe	87
PID 2676 wrote to memory of 2628	2676	cmd.exe	87
PID 2676 wrote to memory of 4544	2676	cmd.exe	88
PID 2676 wrote to memory of 4544	2676	cmd.exe	88
PID 3288 wrote to memory of 2060	3288	cmd.exe	89
PID 3288 wrote to memory of 2060	3288	cmd.exe	89
PID 3288 wrote to memory of 4872	3288	cmd.exe	90
PID 3288 wrote to memory of 4872	3288	cmd.exe	90
PID 4872 wrote to memory of 340	4872	cmd.exe	91
PID 4872 wrote to memory of 340	4872	cmd.exe	91
PID 4872 wrote to memory of 216	4872	cmd.exe	92
PID 4872 wrote to memory of 216	4872	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Pack_Mouse_2.0\MarkC_MouseFix\Disable_WelcomeScreen+Login_Accel.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKEY_USERS\.DEFAULT\Control Panel\Mouse" /v MouseSpeed | find /i "MouseSpeed"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\reg.exe
    reg query "HKEY_USERS\.DEFAULT\Control Panel\Mouse" /v MouseSpeed
    3⤵
    PID:2628
- - C:\Windows\system32\find.exe
    find /i "MouseSpeed"
    3⤵
    PID:4544
- C:\Windows\system32\reg.exe
  reg add "HKEY_USERS\.DEFAULT\Control Panel\Mouse" /v MouseSpeed /d 0 /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKEY_USERS\.DEFAULT\Control Panel\Mouse" /v MouseSpeed | find /i "MouseSpeed"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\reg.exe
    reg query "HKEY_USERS\.DEFAULT\Control Panel\Mouse" /v MouseSpeed
    3⤵
    PID:340
- - C:\Windows\system32\find.exe
    find /i "MouseSpeed"
    3⤵
    PID:216