a7eacf89a3e44c7da784f1e7deb3055c068fa3b4399baf623ec6955c94501e68

Analysis

user interaction
yes
max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 17:01

Target
WindowsOptimizer.bat
Size 17KB
Sample260524-vj3cmsfs7w
SHA256 a7eacf89a3e44c7da784f1e7deb3055c068fa3b4399baf623ec6955c94501e68
MD5 8386f4ada8453ec315d378146d1f77dc
SHA1 615940cbae2b67a1a862a0161dc8e8608b83b466
SHA512 71b6ac8b177c8a6cba62bb50d6d7f547c89beb22dc81f6ef77c89223e2c137ba864be314eb694ec5b0aad1c8db52e049f347dc4275d31e9870964b193273efc9
SSDEEP 384:S3DGG3BxSVoESV1CVtVh/VHFa28WTeTAT0TKTgTET0TYTnThTITbTuTFToTUTkTl:SdROo+P3tTTpc
TLSH
T1738274423F584C5BD195EA3274EF8526FBE422AB50422FC4B0ED625497637DAC37E8C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2356	3424	cmd.exe	88
PID 2356 wrote to memory of 4408	2356	net.exe	89
PID 3424 wrote to memory of 4388	3424	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WindowsOptimizer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4408
- C:\Windows\system32\reg.exe
  reg add "HKCU\Console" /v WindowAlpha /t REG_DWORD /d 215 /f
  2⤵
  PID:4388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4908