8bad38df6bc53845b5bc33883cf10e88dd29df5658da40f01dbbb639d4fd9a87

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 11:12

Target
build.bat
Size 4KB
Sample260511-natktabv8p
SHA256 8bad38df6bc53845b5bc33883cf10e88dd29df5658da40f01dbbb639d4fd9a87
MD5 f9764f7151f59f92e0c9f27ba3346ac4
SHA1 530dbf46d4143bf11c0c4614a2fa1205387732a4
SHA512 e9198a64aa5cb4fd01901ce3f5d2c0298690ec42a45f96ff0a2908f7d7807c0dbe67517bdc6a2e93db3d36e3579dfffb3827967a929aace2deaf003adcd99eea
SSDEEP 48:DqhebeKcQhgle8SQBsYSGuGSzLiy+Eu6OUrEtCAAm3Cv1MHHO7qfbYHFAmiu:2hnKcSfLV+96OUrnXmSv4HO7qCemX
TLSH
T13791E22F3349919FA0719B5BC370069FF602E1DB0A391DEA607603B9614B0C06DFE2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 5060	4180	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\system32\where.exe
  where cargo
  2⤵
  PID:5060