7acb0e2bb3c0e26cc10134d906a5304140183daa3f46b4053aa09552ebc091e8

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 12:44

Target
defnotavirus.exe
Size 206KB
Sample260419-pypr7say2m
SHA256 7acb0e2bb3c0e26cc10134d906a5304140183daa3f46b4053aa09552ebc091e8
MD5 9ba06dd1853050383ade57c5d1b599c7
SHA1 9f67b7ba4df85ae71642d5b386f2a7d699aa529f
SHA512 c192f828b2eca6820b312f36fecd0da2c8a1b1e1f9af3590f5d4d7babae8983c665d7d3bb90aca9b416af9418bf4c31c4cff0674d52e1cb7e31d976aa0f63c98
SSDEEP 3072:mjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfOPhBuYUg:mjK4TDUqgpqWDLZ5H+xuZ04QhA8
TLSH
T111242A02B2A810FDD1BBA37C89A21A41F37A7815477197CF339C856A1F63AD09E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4924	3368	defnotavirus.exe	81

C:\Users\Admin\AppData\Local\Temp\defnotavirus.exe
"C:\Users\Admin\AppData\Local\Temp\defnotavirus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defnotavirus.bat"
  2⤵
  PID:4924

defnotavirus.bat

Path C:\Users\Admin\AppData\Local\Temp\defnotavirus.bat
Size 64KB
SHA256 7ffbe3b0e261fb0be47c3326d01b05dd26cf9115c4945278f52072967a5370b2
MD5 18523e41268558feff2be0327d5d17f3
SHA1 4434890a8be142db7588c1ba100aaffaa17644d2
SHA512 e4995a97441df9277c5136972a06d8d259771b38ed420881e8b439c62431458354cc74260a904cd2c1d1d08216928a402da5d6c31cbed65faf00cd699d100054
SSDEEP 48:YQ+NK5ptanV9TKeoZ3E/cvYZMwIJFcfJmgSihl6MO3:YQ+NiptarK13EAcMyeiP6R
TLSH
T13B539371EA39285B532B62899AB056E9219C31A354FAEE7534BF61F30780DF730BC944
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3368-2-0x0000016919240000-0x00000169192E3000-memory.dmp

Download

memory/3368-12-0x0000016919240000-0x00000169192E3000-memory.dmp

Download