ca9bd9f5d910822ee75b4b8776d0d602590ee405702e640d16e545cb0ee7227b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 01:37

Target
nyx_launcher.bat
Size 4KB
Sample260517-b2b4mae15l
SHA256 ca9bd9f5d910822ee75b4b8776d0d602590ee405702e640d16e545cb0ee7227b
MD5 cfeddb0f53a20f2b40a6e3678b2f6623
SHA1 95041d3696f23a42da323cc50c544805354f5333
SHA512 993fe89dabcdd048dd6ccd2ce1f881dfe4d2d5fb3edd46d5baf3c5dee0fad0850831053e58c81202127f05e31b0cbdb43d3f127fc180e7a40270ae73103beeed
SSDEEP 48:OzicujNe0UHIH29ZO5PDwT9ld4IsIiItsTsiCxPb1PsKQ9OU9YQLNY2BtpXsI/l5:OGtMbHTbGPD4DTXsTBAxPsJLXNB3jl5
TLSH
T1F5A156392514802435B8CD6D81380E41E21EB18BF71199AC745BB5F65FFD582CEFD2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1400	4220	cmd.exe	90
PID 1400 wrote to memory of 4540	1400	cmd.exe	91
PID 1400 wrote to memory of 4364	1400	cmd.exe	92
PID 4220 wrote to memory of 4392	4220	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nyx_launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4540
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4364
- C:\Windows\system32\where.exe
  where kiro-cli
  2⤵
  PID:4392