1311d44212ec37c9d9daeb2b60117d58423667f7be514eb624b823fe1c166542

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 14:30

Target
prn.bat
Size 1KB
Sample260419-rt8evscy3j
SHA256 1311d44212ec37c9d9daeb2b60117d58423667f7be514eb624b823fe1c166542
MD5 d69996696187ea7177a25323c6df22fd
SHA1 29c586e24df24e08ff57366da3affa9e1fb05ab3
SHA512 5e6b70094e26967ff216d2c0c485ec7a5c1f371170b760ac6136f7882a8c69b45e0c97dd6d5b8507f45cfc9f0dbd6fed849535f490c58060a76e721452432435
TLSH
T1D23111A5E998C8891508F49B9E016E4CBB9A01BF77735FB802514C3E39C33E0E32D425
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 4316	3160	cmd.exe	80
PID 3160 wrote to memory of 1144	3160	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\prn.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4316
- C:\Windows\system32\wscript.exe
  wscript.exe //B "C:\Users\Admin\AppData\Local\Temp\fullauto.vbs"
  2⤵
  PID:1144