63de9048668784bad86afb5490d469bb5596170bfc528045e3c0272a1fdd3505

Analysis

max time kernel
84s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 04:32

Target

hwid-window-spoofer-main/hwid_magic.bat
Size

45KB
MD5

a3ab5c1d3d86d27b3764d5ff39adde5e
SHA1

ac8bdc4e94db981ccdb78d0b246f7925b56f7ac7
SHA256

b4412cbb504063c9dff0f4c41f3efbdf836c0fa95a0d932de85cb80df51276d6
SHA512

5fe3819d693745f8595b8b18fa1b3b94f69adbd1575fb2397889d65bfb2b9d70052016ac613365e2df9567b8e3a412bad609c9786e5991e0d08e019d6b17f474
SSDEEP

384:57wK8+SMS8Sn16d/s16JijVAJ9OSU5RCn3I3k4L1oPunRz+eV5pK/F23aKVed+NE:5IKSBL1oP6Rz+Enfdh9YL8oPbT

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3284	5064	cmd.exe	85
PID 5064 wrote to memory of 3284	5064	cmd.exe	85
PID 5064 wrote to memory of 4500	5064	cmd.exe	86
PID 5064 wrote to memory of 4500	5064	cmd.exe	86
PID 5064 wrote to memory of 3128	5064	cmd.exe	87
PID 5064 wrote to memory of 3128	5064	cmd.exe	87
PID 3128 wrote to memory of 4980	3128	cmd.exe	88
PID 3128 wrote to memory of 4980	3128	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hwid-window-spoofer-main\hwid_magic.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
  2⤵
  PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\hwid-window-spoofer-main\hwid_magic.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\findstr.exe
    findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\hwid-window-spoofer-main\hwid_magic.bat"
    3⤵
    PID:4980