180d7e69d9926077fc0eb137bc0cdd00fb438b279e41535b523198e9ba0b04f8

Analysis

user interaction
yes
max time kernel
149s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 19:25

Target
run_cheat.bat
Size 1KB
Sample260511-x5cefscw7j
SHA256 180d7e69d9926077fc0eb137bc0cdd00fb438b279e41535b523198e9ba0b04f8
MD5 fdffc81dea81b8082e7b78efc3084a65
SHA1 eae7161f343caf12503422d53b81ce2b00994183
SHA512 9d7e7f7881eeac27854524c6ce4e74eee56dd43860165d219d1ffd1b151fd1fce7dc15df55e72228dcfe908f82914ceacbe8dbff2d75bad7284ce0cf8e04147e
TLSH
T1A7310E1A728501359384C45E6F0175C57B15436F52A89C3CB1EE83ACBF761968DFCDC5
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 4460	6052	cmd.exe	80
PID 4460 wrote to memory of 5308	4460	net.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run_cheat.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5308