b4c4135c6d4900a344721f210a6f9ad5ae7f3658fa4e1ad99b177313a05d3cce

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 05:54

Target

RIP Tweaks Free Pack V4/Problem Fixes/Fix WiFi.bat
Size

153B
MD5

2f81d06b38c08600c5fd77b386df5d2b
SHA1

66593faa9e05f8fb6a0220e92899890d97e923d9
SHA256

5e3930b01539b45525f96e831c068589d392c1a79df9d20b86610c33c7b6fad4
SHA512

67a020bccb81960e61c374d0c4206c9331c512c205aa1da3968d64e9e3baadcd2e3c67b30e81687c45434fef27bba5e44cbb64923441e5801997161758d8b6f4

Score

4^/10

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Suspicious behavior: LoadsDriver 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1980	2112	cmd.exe	86
PID 2112 wrote to memory of 1980	2112	cmd.exe	86
PID 2112 wrote to memory of 1844	2112	cmd.exe	87
PID 2112 wrote to memory of 1844	2112	cmd.exe	87
PID 2112 wrote to memory of 2132	2112	cmd.exe	89
PID 2112 wrote to memory of 2132	2112	cmd.exe	89
PID 2112 wrote to memory of 2568	2112	cmd.exe	90
PID 2112 wrote to memory of 2568	2112	cmd.exe	90
PID 2112 wrote to memory of 976	2112	cmd.exe	91
PID 2112 wrote to memory of 976	2112	cmd.exe	91
PID 2112 wrote to memory of 808	2112	cmd.exe	92
PID 2112 wrote to memory of 808	2112	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RIP Tweaks Free Pack V4\Problem Fixes\Fix WiFi.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\sc.exe
  sc config Wcmsvc start= auto
  2⤵
  - Launches sc.exe
  PID:1980
- C:\Windows\system32\sc.exe
  sc start Wcmsvc
  2⤵
  - Launches sc.exe
  PID:1844
- C:\Windows\system32\sc.exe
  sc config WlanSvc start= auto
  2⤵
  - Launches sc.exe
  PID:2132
- C:\Windows\system32\sc.exe
  sc start WlanSvc
  2⤵
  - Launches sc.exe
  PID:2568
- C:\Windows\system32\sc.exe
  sc config NativeWifiP start= demand
  2⤵
  - Launches sc.exe
  PID:976
- C:\Windows\system32\sc.exe
  sc start NativeWifiP
  2⤵
  - Launches sc.exe
  PID:808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2260