180d7e69d9926077fc0eb137bc0cdd00fb438b279e41535b523198e9ba0b04f8

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 19:25

Target
run_cheat.bat
Size 1KB
Sample260511-x5cefscw7j
SHA256 180d7e69d9926077fc0eb137bc0cdd00fb438b279e41535b523198e9ba0b04f8
MD5 fdffc81dea81b8082e7b78efc3084a65
SHA1 eae7161f343caf12503422d53b81ce2b00994183
SHA512 9d7e7f7881eeac27854524c6ce4e74eee56dd43860165d219d1ffd1b151fd1fce7dc15df55e72228dcfe908f82914ceacbe8dbff2d75bad7284ce0cf8e04147e
TLSH
T1A7310E1A728501359384C45E6F0175C57B15436F52A89C3CB1EE83ACBF761968DFCDC5
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 3076	628	cmd.exe	86
PID 3076 wrote to memory of 1732	3076	net.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run_cheat.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3212