c15138b150490cf2083611f9507dca7762b7005bd339780e05aaa0bbc89c21c4

Analysis

user interaction
yes
max time kernel
42s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 23:34

Target
BTC_OPTIMIZER_v11.bat
Size 5KB
Sample260418-3krarshy3k
SHA256 c15138b150490cf2083611f9507dca7762b7005bd339780e05aaa0bbc89c21c4
MD5 da6ad269e84f932c23c4ca17ab31c299
SHA1 7ae6eb95a255f928c65afa7d62d4f521e6da0c9d
SHA512 5a1cdf20af9aae806fab6fa20918d37168a9a78adeef88b43894ed97532d15aface0e3a778257ef018f9df9ceefacb31191fcd0f59cfbc7b6b60c3b755e5efaa
SSDEEP 96:ic0rHDWPWQTIPrVyBbVRoeO5h8ctqQfTrXeROrff3X0oQbgH75lkk2:L0rHDhQVwWctTXeRObvX0ohlkR
TLSH
T142B1363274187712252E4E028AB2FCED371444D799316419F1EF4AF43FA6FE0AE495E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 1136	2856	cmd.exe	80
PID 2856 wrote to memory of 3892	2856	cmd.exe	81
PID 3892 wrote to memory of 4328	3892	net.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BTC_OPTIMIZER_v11.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:1136
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4328