32f80f04d936215e00017d445f93489ddedb001a346c9ca04cdbbbd76c96b154 | Triage

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 22:23

Sharing

Report Analysis Logs

General

Target

Pack de Optimizacion by bask1ngg/11. NVIDIA O AMD/NVIDIA/nvidia.cmd
Size

804B
MD5

41f014d298c76925f718e0b2241e2db6
SHA1

6a83ae335cddffc067089b4a19fa3066deb9f01b
SHA256

789f1621fd24496497312457afc8d9a60c2feaf33ee99c6428afe6aed701b523
SHA512

6ad3a2d8e2d3b4e483b7ec46e3c6267914a93c3c5e697caee57d39124b1bf79e713695a435a33cff079fbca1fbffba63adc5356e86a12900ae7ad3e19e654cc2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1244 wrote to memory of 1884	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 1884	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 1884	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 2116	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 2116	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 2116	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 2212	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 2212	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 2212	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 1448	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 1448	1244	cmd.exe	reg.exe
PID 1244 wrote to memory of 1448	1244	cmd.exe	reg.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Pack de Optimizacion by bask1ngg\11. NVIDIA O AMD\NVIDIA\nvidia.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "DisablePreemption" /t REG_DWORD /d 1 /f
2⤵
PID:1884

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "DisableCudaContextPreemption" /t REG_DWORD /d 1 /f
2⤵
PID:2116

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "DisableWriteCombining" /t REG_DWORD /d 1 /f
2⤵
PID:2212

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "BuffersInFlight" /t REG_DWORD /d 4096 /f
2⤵
PID:1448

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...