49bce604beef237d620ab11acedc72fdb2c0e63a0e3b5e7d1deefa11c3420a7f

Resubmissions

26/04/2026, 11:57

26/04/2026, 11:51

26/04/2026, 11:51

26/04/2026, 11:50

max time kernel
598s
max time network
451s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 11:57

Target
nitro free tool/start.bat
Size 123B
Sample260426-n44ymsgz7x
SHA256 49bce604beef237d620ab11acedc72fdb2c0e63a0e3b5e7d1deefa11c3420a7f
MD5 e311560c2728e6ac20e25ba05ec87f22
SHA1 ab1bd94a2f1fd5f7e9b250ce0cd599b76407facc
SHA512 10090f41362dd740b88141ac860355b21746e5dd274282bc4c272a8a05af8fa41766ae71486166e68484dc875e4438905ea10b3b303a879abaae2f2f5b647baa
TLSH
T15AB02B0A24233410ECE60E991C1F2000710000C332313C013183003F4C0BBF6740AC5F
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3792	1180	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nitro free tool\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python main.py
  2⤵
  PID:3792