1303791d5361f853607ab0e98fc6f102c7ac3585358d680a05f20c7f365c302c

Resubmissions

11/05/2024, 16:53

11/05/2024, 16:51

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 16:53

Target
Skiioh's Performance Pack v2 (FREE)/(1) Run This First SkiiohTweaks.bat
Size 9KB
Sample240511-veee1sbb25
SHA256 d3ece4857950aafc233a8bc1b76d9e6b17610ef7f9e00fef19f8cf25967b6aab
MD5 aa57b1f3525fc48b2ea2f103fe22b72e
SHA1 549243c0c1ab4359dbae18292d8d42ee4eab6d31
SHA512 5d99bb07c5f48b6e6aaa74649ea1cebb6648b9311c6d9bc585e93b086966235909bc33f64b2da26c43ca98fd61e113e21e18a9eb66ba1667c5de48d456acbe3e
SSDEEP 192:xbHzjjLiNfAdS5xHiotxnOvcLJCiHMI+IW:9T+NTOm5MI+IW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1420	824	cmd.exe	91
PID 824 wrote to memory of 1420	824	cmd.exe	91
PID 1420 wrote to memory of 1780	1420	cmd.exe	92
PID 1420 wrote to memory of 1780	1420	cmd.exe	92
PID 824 wrote to memory of 3668	824	cmd.exe	93
PID 824 wrote to memory of 3668	824	cmd.exe	93
PID 824 wrote to memory of 3164	824	cmd.exe	94
PID 824 wrote to memory of 3164	824	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Skiioh's Performance Pack v2 (FREE)\(1) Run This First SkiiohTweaks.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:1780
- C:\Windows\system32\chcp.com
  chcp 708
  2⤵
  PID:3668
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Skiioh's Performance Pack v2 (FREE)\(1) Run This First SkiiohTweaks.bat" "
  2⤵
  PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4068