1303791d5361f853607ab0e98fc6f102c7ac3585358d680a05f20c7f365c302c

Resubmissions

11-05-2024 16:53

11-05-2024 16:51

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 16:53

Target

Skiioh's Performance Pack v2 (FREE)/(5) Cache Cleaner SkiiohTweaks.bat
Size

4KB
MD5

85d5de5befac59eadc881ea230312605
SHA1

de0c215233323917d6ec6521be56a1acc7437aef
SHA256

8ebfee7dbf72cf4f13b1862597990e570c144bcc3208261956a6770dcefbb350
SHA512

d7434480d282140a2c57c5deeb07f44b25c56f5eb4eef82df7c048cb46f62610d1fd2e6b458416de2fadc2e98943de9578082f54b9adfb6ce20a2223f01b869a
SSDEEP

48:j1HDTLTDfLT7Ptgst2ycwAigRojvc/5/E/o/m/a/q/x/7FKHvHHHHHPHlcHxHsH3:h3Pf3THz0RrHvHHHHHPHlcHxHsHkE

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1756	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1844	1264	cmd.exe	29
PID 1264 wrote to memory of 1844	1264	cmd.exe	29
PID 1264 wrote to memory of 1844	1264	cmd.exe	29
PID 1844 wrote to memory of 2184	1844	cmd.exe	30
PID 1844 wrote to memory of 2184	1844	cmd.exe	30
PID 1844 wrote to memory of 2184	1844	cmd.exe	30
PID 1264 wrote to memory of 1780	1264	cmd.exe	31
PID 1264 wrote to memory of 1780	1264	cmd.exe	31
PID 1264 wrote to memory of 1780	1264	cmd.exe	31
PID 1264 wrote to memory of 1756	1264	cmd.exe	32
PID 1264 wrote to memory of 1756	1264	cmd.exe	32
PID 1264 wrote to memory of 1756	1264	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Skiioh's Performance Pack v2 (FREE)\(5) Cache Cleaner SkiiohTweaks.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2184
- C:\Windows\system32\chcp.com
  chcp 708
  2⤵
  PID:1780
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Skiioh's Performance Pack v2 (FREE)\(5) Cache Cleaner SkiiohTweaks.bat" "
  2⤵
  - Deletes itself
  PID:1756