fe79f0f7e5dd27d1ca5d0d6d6d18502f8cd768eac206dd0cb4a5415a0147c053

Analysis

user interaction
yes
max time kernel
16s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 23:50

Target
macOS-Large-Windows/uninstall.bat
Size 922B
Sample260428-3vnbvsft3x
SHA256 fe79f0f7e5dd27d1ca5d0d6d6d18502f8cd768eac206dd0cb4a5415a0147c053
MD5 9ca5ef0165cf650e705a7e07b3f1a0da
SHA1 cdc48a4e381242a6430ec5bf6f76ced1d2eb2f68
SHA512 8baf8dc7edb0ad7110e3678896206ba3da5bf4f2f0e8779d818b637a2b15c2417f28802ade683865bfdb870285f75debc77150db090e3116221e2329c2947869
TLSH
T11A1141D39A88A3570FC663C154A0A0FF40B3E0BA8742C86C707E8028631D3E1139BAB5
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4312	3076	cmd.exe	80
PID 3076 wrote to memory of 3344	3076	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\macOS-Large-Windows\uninstall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\system32\reg.exe
  REG DELETE "HKCU\Control Panel\Cursors\Schemes" /v "macOS-Large Cursors" /f
  2⤵
  PID:4312
- C:\Windows\system32\wscript.exe
  wscript C:\Users\Admin\AppData\Local\Temp\tmp.vbs
  2⤵
  PID:3344

tmp.vbs

Path C:\Users\Admin\AppData\Local\Temp\tmp.vbs
Size 63B
SHA256 cabd51243c5ca6d63a86df12526d723a16889ec1a297371d1264218088e0db34
MD5 82e2e9a610d57fb10b8c27aefefd0e1e
SHA1 e1e6515406d4df0256aa125735ab9b1120721d1b
SHA512 f64fd297fcd78d7672bb01ee5ab9e8ac5a14da95b82ea83a0f3c75d7eba6ea46fc8fdc5f00ed68bfa4bfc9d85c1597741ff62464abcda2abaf050f231fe3e953
TLSH
T1F5A022823B080B83A0E028820CC0288F000CE0300208CA00088E888C08BE00220A00B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3344-2-0x000002724C130000-0x000002724C13C000-memory.dmp

Download