fc84be70e85351c4e63168014dbb676874a3e1fb27f1d9ed570ca005b9a67021

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/11/2024, 17:29

Target
bsod fix.bat
Size 415B
Sample241102-v21lrs1djm
SHA256 318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
MD5 392f331dc1744fbe560a2a17d7ca838f
SHA1 817559945e137d036f47b26696d4fab5f22572c1
SHA512 0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2312	1620	cmd.exe	31
PID 1620 wrote to memory of 2312	1620	cmd.exe	31
PID 1620 wrote to memory of 2312	1620	cmd.exe	31
PID 2312 wrote to memory of 2216	2312	net.exe	32
PID 2312 wrote to memory of 2216	2312	net.exe	32
PID 2312 wrote to memory of 2216	2312	net.exe	32
PID 1620 wrote to memory of 1216	1620	cmd.exe	33
PID 1620 wrote to memory of 1216	1620	cmd.exe	33
PID 1620 wrote to memory of 1216	1620	cmd.exe	33
PID 1620 wrote to memory of 2092	1620	cmd.exe	34
PID 1620 wrote to memory of 2092	1620	cmd.exe	34
PID 1620 wrote to memory of 2092	1620	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bsod fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\net.exe
  NET SESSION
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 SESSION
    3⤵
    PID:2216
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3
  2⤵
  PID:1216
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3
  2⤵
  PID:2092