445bc69abbd0eba7c5c4092561043eb80cde9ce361d970782837431f23460e87

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
26/06/2024, 17:38

Target
fps boost tweak/2 Cleanup/Delete Update Cache.cmd
Size 173B
Sample240626-v73cjsvdmc
SHA256 a135f1e1152a64cf79e0c6c4a7ad27b8a94d07f4655567bd9dc27430e3d33ff7
MD5 28c41cf9dbfa80376b75bfac670cbc4f
SHA1 8d6c4ee85b9bb814252f96029cb541948c17067b
SHA512 acd66c78af39a3d238044ebbffbb6cc57e811bb5e0ac0d9be7f634db1e16486459f84a88e4e323c6048db2a6a0c560f8ea0f53a35a597e23f2a24b17cb033cc3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 2428	3152	cmd.exe	81
PID 3152 wrote to memory of 2428	3152	cmd.exe	81
PID 2428 wrote to memory of 920	2428	net.exe	82
PID 2428 wrote to memory of 920	2428	net.exe	82
PID 3152 wrote to memory of 4344	3152	cmd.exe	83
PID 3152 wrote to memory of 4344	3152	cmd.exe	83
PID 4344 wrote to memory of 4956	4344	net.exe	84
PID 4344 wrote to memory of 4956	4344	net.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fps boost tweak\2 Cleanup\Delete Update Cache.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:920
- C:\Windows\system32\net.exe
  net stop UsoSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop UsoSvc
    3⤵
    PID:4956