8674a8f3b4507776a16830ee14c24c1771b4e7766c49ca6b348332e04f5338eb

Analysis

max time kernel
149s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 14:36

Target
lualibs/luacheck/stages/linearize.bat
Size 17KB
Sample260518-rywlvset9w
SHA256 8674a8f3b4507776a16830ee14c24c1771b4e7766c49ca6b348332e04f5338eb
MD5 19dbfaea03be9c676dec7d3082923d1c
SHA1 47732a9242a6193859e843f79cb7c0d7e0472da4
SHA512 3f8eb9ffea84c100b98da3d0ae5dd7c49f3a5aab0e9d34cee10ee0d2f7747bab6fccfe753f44ae1e3d985811840640c0510a405f93c9d719cf74fc7ac374c9e7
SSDEEP 384:UNgdcKfM4HxpPPnoHfwiDmPEdTp4AlVAeCkkA6X2:UNgdzM4RpPPnoHfwidvvX9
TLSH
T183820E2EE01225925747BC617C4F6402B9AE1417E68C6CB1FA6D42C81F7963D41FBEF8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1724	2924	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lualibs\luacheck\stages\linearize.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\label.exe
  label = label.name
  2⤵
  PID:1724