8748d92b63085a5f6b86f24e11721982b2275a38669e60ea96f6bb9ff7a35f68

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 17:07

Target

Icon控制专集/Display different icons in explorer for VB projects/UnInstall.bat
Size

53B
MD5

75821a1be3f2860f94bd3d5a568b774c
SHA1

09ca8feded4596a4b1e5e3a7741ea7a001afcfcc
SHA256

208b6457cb526d572df90a312363ce4badbd10d629fb83e8bff9c8f45a86bcda
SHA512

fee01e96dc241a6a9b851adf222a6ee168ca8d7a589caec0914629ea51ca89dfc4f604b2d93fb69fd6f636aae2d4fd807b8de59355a3de7cedab3efee2539b81

Score

1^/10

Runs .reg file with regedit 1 IoCs

pid	Process
4124	regedit.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 4124	2488	cmd.exe	85
PID 2488 wrote to memory of 4124	2488	cmd.exe	85
PID 2488 wrote to memory of 548	2488	cmd.exe	86
PID 2488 wrote to memory of 548	2488	cmd.exe	86
PID 548 wrote to memory of 2456	548	regsvr32.exe	87
PID 548 wrote to memory of 2456	548	regsvr32.exe	87
PID 548 wrote to memory of 2456	548	regsvr32.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Icon控制专集\Display different icons in explorer for VB projects\UnInstall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\regedit.exe
  regedit /s UnInstall.reg
  2⤵
  - Runs .reg file with regedit
  PID:4124
- C:\Windows\system32\regsvr32.exe
  regsvr32 /u /s Icons4VB.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\SysWOW64\regsvr32.exe
    /u /s Icons4VB.dll
    3⤵
    PID:2456