2b40d424237ca996aeb4106ede91f3a831dc106781f7f79196fe10b9efbe98de

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 01:29

Target

!!BEST TWEAKS/Registry _ Batch/EnableFSE.bat
Size

449B
MD5

55d6c6bc4bcb289fa38b279abae4cdd5
SHA1

1b338d5b1f992e2a44e0a9bd52f6908f4ad44125
SHA256

84000ccc7ea1a576cb5a35430b219bccc40b521eaf9befca0f06d3447720d5a3
SHA512

a49109c49c52a9aae3738fc20bdd2ab5c990056b985dc0ee42b908f8b97356705b4d6b349c3d4bc4b865d954aed6daf3d03c4f5f7b0b56058ad3e9ee652e0548

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1448	timeout.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2480	2452	cmd.exe	29
PID 2452 wrote to memory of 2480	2452	cmd.exe	29
PID 2452 wrote to memory of 2480	2452	cmd.exe	29
PID 2452 wrote to memory of 1884	2452	cmd.exe	30
PID 2452 wrote to memory of 1884	2452	cmd.exe	30
PID 2452 wrote to memory of 1884	2452	cmd.exe	30
PID 2452 wrote to memory of 2116	2452	cmd.exe	31
PID 2452 wrote to memory of 2116	2452	cmd.exe	31
PID 2452 wrote to memory of 2116	2452	cmd.exe	31
PID 2452 wrote to memory of 2212	2452	cmd.exe	32
PID 2452 wrote to memory of 2212	2452	cmd.exe	32
PID 2452 wrote to memory of 2212	2452	cmd.exe	32
PID 2452 wrote to memory of 1448	2452	cmd.exe	33
PID 2452 wrote to memory of 1448	2452	cmd.exe	33
PID 2452 wrote to memory of 1448	2452	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\!!BEST TWEAKS\Registry _ Batch\EnableFSE.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\System\GameConfigStore" /v "GameDVR_Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2480
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\System\GameConfigStore" /v "GameDVR_FSEBehaviorMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:1884
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\System\GameConfigStore" /v "GameDVR_HonorUserFSEBehaviorMode" /t REG_DWORD /d "1" /f
  2⤵
  PID:2116
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\System\GameConfigStore" /v "GameDVR_DXGIHonorFSEWindowsCompatible" /t REG_DWORD /d "1" /f
  2⤵
  PID:2212
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:1448