6740d0ca97c88527b23da8c7f6e03066f9c529d0a2e8ff88ddbfed5f0fd34b27

Analysis

max time kernel
95s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 18:57

Target

Oneclick-main/Downloads/AMD.bat
Size

364B
MD5

4f432879f0b02c48301741a208cd1309
SHA1

12f08180a3e9479e3ede245aa7904b1c85a61d37
SHA256

0617bbd07889ed453dffaf7ccefd7bbf1f092ca6dcb1d9d354efab231f8d385f
SHA512

9971d9076b038cd453e70b90cd408802a7ca4279ce1fc01395dcd9a341bca3d21b7d37491a1525935456816a20aba889586c6594da2bdcb44bba601627e1eedf

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4220	1472	cmd.exe	84
PID 1472 wrote to memory of 4220	1472	cmd.exe	84
PID 1472 wrote to memory of 4468	1472	cmd.exe	85
PID 1472 wrote to memory of 4468	1472	cmd.exe	85
PID 1472 wrote to memory of 1204	1472	cmd.exe	86
PID 1472 wrote to memory of 1204	1472	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-main\Downloads\AMD.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AMD Crash Defender Service" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4220
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AMD External Events Utility" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AUEPLauncher" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1204