d79747853972fde1d445a9c6facab65abef36cfd1a0db6b3b47b78cd0f7f675e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 04:02

Target
tmp16meehls.js
Size 483KB
Sample260523-el6vvafs21
SHA256 d79747853972fde1d445a9c6facab65abef36cfd1a0db6b3b47b78cd0f7f675e
MD5 0dfe209fa967d66333b12e8e9600d3dd
SHA1 642eaee37bf514f418d2df32a87b161228c9f65b
SHA512 0ba9f6b6436dc8a14968bfbe3e9cd50cdb13cab534b59893e4d476691aa2cf072d164271e76f0021692382dcce0e0425644c8be6cf4641a748e39d3f9d0ff97d
SSDEEP 6144:WQGpXWTula/l4khEfD3xArWiagmd4iLAmWg6lSF:njhEfD3xTiagmd4iLAmWg6i
TLSH
T147B4B40EABEB332AC51371799F5F9004A535840B661AEC1D7D4C93880F5863D9ABBFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5304	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmp16meehls.js
1⤵
- Badlisted process makes network request
PID:5304

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact