b9dcc65c2b9f04554a887a911120da011ae30722017eaa7cd215702e9ac04105

Analysis

user interaction
yes
max time kernel
18s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 23:50

Target
macOS-Extra-Large-Windows/uninstall.bat
Size 928B
Sample260428-3vnbvsft3x
SHA256 b9dcc65c2b9f04554a887a911120da011ae30722017eaa7cd215702e9ac04105
MD5 707a2c309366ceab8a22aff0f1cd0116
SHA1 ac65ae0049d6346ff8ec99508294dfd01bc5d8d7
SHA512 e0cd97793000282711f1240ec587412b3a41fe1006fa3cc17cf8261ec4193fb601fbe8cf2b16d60d1b5979d003faaec701214a8af9dc078c831157868c21e3d2
TLSH
T1B11141D39A88E3470FC663C255A0A0FF50B3E0B98742C86C707E8028631D3E1139BAB5
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 3184	2636	cmd.exe	80
PID 2636 wrote to memory of 3516	2636	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\macOS-Extra-Large-Windows\uninstall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\system32\reg.exe
  REG DELETE "HKCU\Control Panel\Cursors\Schemes" /v "macOS-Extra-Large Cursors" /f
  2⤵
  PID:3184
- C:\Windows\system32\wscript.exe
  wscript C:\Users\Admin\AppData\Local\Temp\tmp.vbs
  2⤵
  PID:3516

tmp.vbs

Path C:\Users\Admin\AppData\Local\Temp\tmp.vbs
Size 63B
SHA256 cabd51243c5ca6d63a86df12526d723a16889ec1a297371d1264218088e0db34
MD5 82e2e9a610d57fb10b8c27aefefd0e1e
SHA1 e1e6515406d4df0256aa125735ab9b1120721d1b
SHA512 f64fd297fcd78d7672bb01ee5ab9e8ac5a14da95b82ea83a0f3c75d7eba6ea46fc8fdc5f00ed68bfa4bfc9d85c1597741ff62464abcda2abaf050f231fe3e953
TLSH
T1F5A022823B080B83A0E028820CC0288F000CE0300208CA00088E888C08BE00220A00B0
MD5 SHA1 SHA512 TLSH

Submit Download