fc84be70e85351c4e63168014dbb676874a3e1fb27f1d9ed570ca005b9a67021

Analysis

max time kernel
133s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2024, 17:29

Target
bsod fix.bat
Size 415B
Sample241102-v21lrs1djm
SHA256 318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
MD5 392f331dc1744fbe560a2a17d7ca838f
SHA1 817559945e137d036f47b26696d4fab5f22572c1
SHA512 0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1872	864	cmd.exe	85
PID 864 wrote to memory of 1872	864	cmd.exe	85
PID 1872 wrote to memory of 3440	1872	net.exe	86
PID 1872 wrote to memory of 3440	1872	net.exe	86
PID 864 wrote to memory of 2288	864	cmd.exe	87
PID 864 wrote to memory of 2288	864	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bsod fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\system32\net.exe
  NET SESSION
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 SESSION
    3⤵
    PID:3440
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3
  2⤵
  PID:2288