b9689c8a90dd69824c85df024cdeb2b2bb6d93270f0793ec5146afa3f266db44

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/05/2026, 14:36

Target
lualibs/luacheck/format.bat
Size 10KB
Sample260518-rywlvset9w
SHA256 b9689c8a90dd69824c85df024cdeb2b2bb6d93270f0793ec5146afa3f266db44
MD5 f9a809a5d9614aac17d38e5f22ebe1df
SHA1 bfadcf2f543e8deca6f446802be9cb6759de9fc6
SHA512 cea2b855caccd67420a76966f9d43d40f4b97e050be02f24637a6e46b2bc20f9a18da68dc7c0f2c55284c1e9859be2e93a804943bd345c7f906d74e77eaa058e
SSDEEP 192:TGLPradFeki3UTPEoKL6QVJK0CVZCPR0YRhOaG+KmlCuMcqBG0EmDoJTSv:TGfajekiEjKL64YeNG+tYi8
TLSH
T119223249D9892D301343C8EDA9EBA649BF68605305081117B6EE4B912F11D7EE3F7BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 4424	3768	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lualibs\luacheck\format.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\system32\reset.exe
  reset = 0,
  2⤵
  PID:4424