15da92deed9ed53b70d0a8c446a5bb9db7ed506634ea3cd206f06d11e8038821

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 14:47

Target

kiwi's roblox shaders/Kiwi's Shaders Installer.bat
Size

7KB
MD5

c72ec3a0a12170d18107bc1ed4cecbee
SHA1

6a609f36c210b620f72a028c39f5ba10ba9c4f7f
SHA256

25217e4e9b7399af315e282ac07b828a844a5108dcc7e0fab3d313b3bc2f5dec
SHA512

b934b2da1034193fbe3d6c279f88e8b05920e0a1a07f6751c8355e8a2f96aa2a0b92ca5fe543d4b4fce75fca0b02af6d1a0bb725dfd8ec14faebf5f8d6c45ca8
SSDEEP

96:gwdbIFOhkZ83qdXJd10FT0ySuhCL04hsOG8qO+LnQMqO+LPx3zjs3Skyd3ZsSrI7:FIDZ8YyfIL04+R8H+DzH+dns3SptTmpP

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2892	1444	cmd.exe	84
PID 1444 wrote to memory of 2892	1444	cmd.exe	84
PID 1444 wrote to memory of 2180	1444	cmd.exe	85
PID 1444 wrote to memory of 2180	1444	cmd.exe	85
PID 2180 wrote to memory of 1736	2180	net.exe	86
PID 2180 wrote to memory of 1736	2180	net.exe	86
PID 1444 wrote to memory of 2720	1444	cmd.exe	87
PID 1444 wrote to memory of 2720	1444	cmd.exe	87
PID 1444 wrote to memory of 3432	1444	cmd.exe	88
PID 1444 wrote to memory of 3432	1444	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\kiwi's roblox shaders\Kiwi's Shaders Installer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\kiwi's roblox shaders\Kiwi's Shaders Installer.bat"" null firstrun
  2⤵
  PID:2892
- C:\Windows\system32\net.exe
  NET FILE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 FILE
    3⤵
    PID:1736
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\kiwi's roblox shaders\Kiwi's Shaders Installer.bat"" skipuac firstrun
  2⤵
  PID:2720
- C:\Windows\system32\mode.com
  mode 65, 25
  2⤵
  PID:3432