6ddaadc624ff9cbf20d7b768591ce49673bd818d8201e746254a1bd329d44f63

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 08:42

Target

FPS Boost Pack/Batch Optimizations/Disable HPET.cmd
Size

281B
MD5

66bef50ad05530603269559082ca9237
SHA1

b3ecd788acaf8a53f63f6e3a5368db80a1735c7f
SHA256

9ba48d6db5fe00c33b4a22a9f0590cbb2746eced74ab0f98233852ac43897b8d
SHA512

fcf6171f506f32241ed0a94107c3055bcdfc7397aa4155739aa131236b48f9aac4522214598985e28c1480764fb6f57d50f5cd65aaa83e78c630b64533da06e9

Score

9^/10

Modifies boot configuration data using bcdedit 3 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2772	1612	cmd.exe	29
PID 1612 wrote to memory of 2772	1612	cmd.exe	29
PID 1612 wrote to memory of 2772	1612	cmd.exe	29
PID 1612 wrote to memory of 2116	1612	cmd.exe	30
PID 1612 wrote to memory of 2116	1612	cmd.exe	30
PID 1612 wrote to memory of 2116	1612	cmd.exe	30
PID 1612 wrote to memory of 2520	1612	cmd.exe	31
PID 1612 wrote to memory of 2520	1612	cmd.exe	31
PID 1612 wrote to memory of 2520	1612	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\FPS Boost Pack\Batch Optimizations\Disable HPET.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue useplatformclock
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2772
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2116
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2520