af9327f7cfa028f3061c488d3cd389119993325ffb2c236f66ea410be756c88d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 00:32

Target
svc.bat
Size 829B
Sample260426-avk8aabv41
SHA256 af9327f7cfa028f3061c488d3cd389119993325ffb2c236f66ea410be756c88d
MD5 cb92b7a7e7de5b41b0402aa7c162d439
SHA1 5150d1a65e1b1cfaf9ca816d4a26fa8f5efd35dd
SHA512 e960f8a7537aaa10cd246979a738a3052e6c8a7ad94b148b6620e15faaf04e9da0883c9a1e9b11ce0c9a8b0fab5977c37b2b783c994cd67618079df82e938ff6
TLSH
T16101E54AF0E55C72DF2C15E0DE4A15063B1E8589E3827BF610D60C21CE026E9C1A53F9
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 460	1200	cmd.exe	80
PID 460 wrote to memory of 3392	460	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\svc.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\~svc.bat" clean "C:\Users\Admin\AppData\Local\Temp\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Windows\system32\conhost.exe
    conhost.exe --headless "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MpEng.exe" "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\update.dll" conssnet "C:\Users\Admin\AppData\Local\Temp\.."
    3⤵
    PID:3392

~svc.bat

Path C:\Users\Admin\AppData\Local\Temp\~svc.bat
Size 829B
SHA256 af9327f7cfa028f3061c488d3cd389119993325ffb2c236f66ea410be756c88d
MD5 cb92b7a7e7de5b41b0402aa7c162d439
SHA1 5150d1a65e1b1cfaf9ca816d4a26fa8f5efd35dd
SHA512 e960f8a7537aaa10cd246979a738a3052e6c8a7ad94b148b6620e15faaf04e9da0883c9a1e9b11ce0c9a8b0fab5977c37b2b783c994cd67618079df82e938ff6
TLSH
T16101E54AF0E55C72DF2C15E0DE4A15063B1E8589E3827BF610D60C21CE026E9C1A53F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/460-2-0x000001D4F1EF0000-0x000001D4F1F9F000-memory.dmp

Download