2709b3d83fe1195f41f8d4fa3007a191111c54311f1d79fa75f02adea995fd66

Analysis

user interaction
yes
max time kernel
12s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 23:50

Target
macOS-Regular-Windows/uninstall.bat
Size 924B
Sample260428-3vnbvsft3x
SHA256 2709b3d83fe1195f41f8d4fa3007a191111c54311f1d79fa75f02adea995fd66
MD5 cc9da706d24e34d82beb3eeb4b9c33cb
SHA1 cc6c736f92f16ed5bbd4ce7fcfac4879d5c5a498
SHA512 92b2a9f65df4b48e26c38d6e0ae2053a3d663bbac3991c6292f28ce83e866100a7f4674c4190aab76016e5433ac78140699defed057ae87637bca8d18ebd972c
TLSH
T17A11E1D39A8CA3570FC667C195A090FF51B3E0BD8742D86C707D8068631D3E11797AB5
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 3716	1184	cmd.exe	81
PID 1184 wrote to memory of 4304	1184	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\macOS-Regular-Windows\uninstall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\reg.exe
  REG DELETE "HKCU\Control Panel\Cursors\Schemes" /v "macOS-Regular Cursors" /f
  2⤵
  PID:3716
- C:\Windows\system32\wscript.exe
  wscript C:\Users\Admin\AppData\Local\Temp\tmp.vbs
  2⤵
  PID:4304

tmp.vbs

Path C:\Users\Admin\AppData\Local\Temp\tmp.vbs
Size 63B
SHA256 cabd51243c5ca6d63a86df12526d723a16889ec1a297371d1264218088e0db34
MD5 82e2e9a610d57fb10b8c27aefefd0e1e
SHA1 e1e6515406d4df0256aa125735ab9b1120721d1b
SHA512 f64fd297fcd78d7672bb01ee5ab9e8ac5a14da95b82ea83a0f3c75d7eba6ea46fc8fdc5f00ed68bfa4bfc9d85c1597741ff62464abcda2abaf050f231fe3e953
TLSH
T1F5A022823B080B83A0E028820CC0288F000CE0300208CA00088E888C08BE00220A00B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4304-2-0x0000026933D60000-0x0000026933D6C000-memory.dmp

Download