e49119fafd7d6b61c743dec7446a6239f6a5b068f42eee5b108a2804ce5922b0

Resubmissions

11/05/2026, 08:22

11/05/2026, 08:22

user interaction
yes
max time kernel
18s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 08:22

Target
MetaData.translate.bat
Size 6KB
Sample260511-j9mt4ads9v
SHA256 e49119fafd7d6b61c743dec7446a6239f6a5b068f42eee5b108a2804ce5922b0
MD5 c805b43638420dbc75c818af5e4ac386
SHA1 a54ceb2f67b47da04c858edc70a1de22f62288df
SHA512 93592f54330fb376ba29e722c7471e0f398543021f9355dc5201c59fcb5b2310cf0d93fd4c9eaf64fa9dfa68b9a453db24e361ac323963785b1088d32c5f394b
SSDEEP 192:h0hGgFRRtklXWDdorBxpNEYy6q4nbKfiKkqK8:0Lvk2oEYy6y
TLSH
T130D17239353B77A5110E8E639582B5126490427F02D6ADBEF88E909C2FD97C856ECEB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1320	1828	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MetaData.translate.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\system32\where.exe
  where git
  2⤵
  PID:1320