c0f0d33d18d79c58d0956a5057ec26407d50bebb8960514ceb88d7fb7fb2502b

Analysis

max time kernel
90s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10/01/2025, 21:45

Target

OneclickTools/Amd/AMD.bat
Size

364B
MD5

4f432879f0b02c48301741a208cd1309
SHA1

12f08180a3e9479e3ede245aa7904b1c85a61d37
SHA256

0617bbd07889ed453dffaf7ccefd7bbf1f092ca6dcb1d9d354efab231f8d385f
SHA512

9971d9076b038cd453e70b90cd408802a7ca4279ce1fc01395dcd9a341bca3d21b7d37491a1525935456816a20aba889586c6594da2bdcb44bba601627e1eedf

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 2040	3512	cmd.exe	79
PID 3512 wrote to memory of 2040	3512	cmd.exe	79
PID 3512 wrote to memory of 4988	3512	cmd.exe	80
PID 3512 wrote to memory of 4988	3512	cmd.exe	80
PID 3512 wrote to memory of 4100	3512	cmd.exe	81
PID 3512 wrote to memory of 4100	3512	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OneclickTools\Amd\AMD.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AMD Crash Defender Service" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2040
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AMD External Events Utility" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AUEPLauncher" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4100