66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 23:20

Target
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/bsod fix.bat
Size 415B
Sample240811-3bewdaybpc
SHA256 318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
MD5 392f331dc1744fbe560a2a17d7ca838f
SHA1 817559945e137d036f47b26696d4fab5f22572c1
SHA512 0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2372	3020	cmd.exe	31
PID 3020 wrote to memory of 2372	3020	cmd.exe	31
PID 3020 wrote to memory of 2372	3020	cmd.exe	31
PID 2372 wrote to memory of 2508	2372	net.exe	32
PID 2372 wrote to memory of 2508	2372	net.exe	32
PID 2372 wrote to memory of 2508	2372	net.exe	32
PID 3020 wrote to memory of 2540	3020	cmd.exe	33
PID 3020 wrote to memory of 2540	3020	cmd.exe	33
PID 3020 wrote to memory of 2540	3020	cmd.exe	33
PID 3020 wrote to memory of 2544	3020	cmd.exe	34
PID 3020 wrote to memory of 2544	3020	cmd.exe	34
PID 3020 wrote to memory of 2544	3020	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\bsod fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\net.exe
  NET SESSION
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 SESSION
    3⤵
    PID:2508
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3
  2⤵
  PID:2544