2311bcb7fd606d51b262f905f48adc1d7c97bf7a336b61e9e8c799bccc89ebf0

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/05/2026, 19:54

Target
winactivation tool.bat
Size 1KB
Sample260515-ymmcdaat8n
SHA256 2311bcb7fd606d51b262f905f48adc1d7c97bf7a336b61e9e8c799bccc89ebf0
MD5 db99693d8e183f8b70fac78a8d238989
SHA1 4f65112d1519eb5ab832a334e82462d733f67046
SHA512 022293c5c350b73d8785b9493cd9d76a76f4eb42c4b3ece47e3a09dc9f48380b9b358467a7b1f65579f25a45867ec85022306ae54e71b1930ed845f323e9dd9a
TLSH
T18921CB837434E4D1397E0FCA8D326187B96162E388445AA4B05F00B857C57CA7AEDA6A
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 5708	5136	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\winactivation tool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Windows\system32\mode.com
  mode con: cols=65 lines=25
  2⤵
  PID:5708