8748d92b63085a5f6b86f24e11721982b2275a38669e60ea96f6bb9ff7a35f68

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 17:07

Target

Icon控制专集/Display different icons in explorer for VB projects/UnInstall.bat
Size

53B
MD5

75821a1be3f2860f94bd3d5a568b774c
SHA1

09ca8feded4596a4b1e5e3a7741ea7a001afcfcc
SHA256

208b6457cb526d572df90a312363ce4badbd10d629fb83e8bff9c8f45a86bcda
SHA512

fee01e96dc241a6a9b851adf222a6ee168ca8d7a589caec0914629ea51ca89dfc4f604b2d93fb69fd6f636aae2d4fd807b8de59355a3de7cedab3efee2539b81

Score

1^/10

Runs .reg file with regedit 1 IoCs

pid	Process
2516	regedit.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2544	regsvr32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2516	3032	cmd.exe	29
PID 3032 wrote to memory of 2516	3032	cmd.exe	29
PID 3032 wrote to memory of 2516	3032	cmd.exe	29
PID 3032 wrote to memory of 2544	3032	cmd.exe	30
PID 3032 wrote to memory of 2544	3032	cmd.exe	30
PID 3032 wrote to memory of 2544	3032	cmd.exe	30
PID 3032 wrote to memory of 2544	3032	cmd.exe	30
PID 3032 wrote to memory of 2544	3032	cmd.exe	30
PID 2544 wrote to memory of 2520	2544	regsvr32.exe	31
PID 2544 wrote to memory of 2520	2544	regsvr32.exe	31
PID 2544 wrote to memory of 2520	2544	regsvr32.exe	31
PID 2544 wrote to memory of 2520	2544	regsvr32.exe	31
PID 2544 wrote to memory of 2520	2544	regsvr32.exe	31
PID 2544 wrote to memory of 2520	2544	regsvr32.exe	31
PID 2544 wrote to memory of 2520	2544	regsvr32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Icon控制专集\Display different icons in explorer for VB projects\UnInstall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\regedit.exe
  regedit /s UnInstall.reg
  2⤵
  - Runs .reg file with regedit
  PID:2516
- C:\Windows\system32\regsvr32.exe
  regsvr32 /u /s Icons4VB.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\regsvr32.exe
    /u /s Icons4VB.dll
    3⤵
    PID:2520