66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 23:20

Target
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/bsod fix.bat
Size 415B
Sample240811-3bewdaybpc
SHA256 318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
MD5 392f331dc1744fbe560a2a17d7ca838f
SHA1 817559945e137d036f47b26696d4fab5f22572c1
SHA512 0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4164	4792	cmd.exe	86
PID 4792 wrote to memory of 4164	4792	cmd.exe	86
PID 4164 wrote to memory of 2008	4164	net.exe	87
PID 4164 wrote to memory of 2008	4164	net.exe	87
PID 4792 wrote to memory of 1740	4792	cmd.exe	88
PID 4792 wrote to memory of 1740	4792	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Unlock All\bsod fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\net.exe
  NET SESSION
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 SESSION
    3⤵
    PID:2008
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3
  2⤵
  PID:1740