9422365acf6002368d3752faa01d4a428adee1fe902fce397d024dabb4e009b3

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 22:50

Target

OneclickTools/Amd/AMD Bloat.bat
Size

364B
MD5

4f432879f0b02c48301741a208cd1309
SHA1

12f08180a3e9479e3ede245aa7904b1c85a61d37
SHA256

0617bbd07889ed453dffaf7ccefd7bbf1f092ca6dcb1d9d354efab231f8d385f
SHA512

9971d9076b038cd453e70b90cd408802a7ca4279ce1fc01395dcd9a341bca3d21b7d37491a1525935456816a20aba889586c6594da2bdcb44bba601627e1eedf

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2504	2272	cmd.exe	31
PID 2272 wrote to memory of 2504	2272	cmd.exe	31
PID 2272 wrote to memory of 2504	2272	cmd.exe	31
PID 2272 wrote to memory of 3000	2272	cmd.exe	32
PID 2272 wrote to memory of 3000	2272	cmd.exe	32
PID 2272 wrote to memory of 3000	2272	cmd.exe	32
PID 2272 wrote to memory of 2912	2272	cmd.exe	33
PID 2272 wrote to memory of 2912	2272	cmd.exe	33
PID 2272 wrote to memory of 2912	2272	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OneclickTools\Amd\AMD Bloat.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AMD Crash Defender Service" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2504
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AMD External Events Utility" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AUEPLauncher" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2912