a7eacf89a3e44c7da784f1e7deb3055c068fa3b4399baf623ec6955c94501e68

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 17:01

Target
WindowsOptimizer.bat
Size 17KB
Sample260524-vj3cmsfs7w
SHA256 a7eacf89a3e44c7da784f1e7deb3055c068fa3b4399baf623ec6955c94501e68
MD5 8386f4ada8453ec315d378146d1f77dc
SHA1 615940cbae2b67a1a862a0161dc8e8608b83b466
SHA512 71b6ac8b177c8a6cba62bb50d6d7f547c89beb22dc81f6ef77c89223e2c137ba864be314eb694ec5b0aad1c8db52e049f347dc4275d31e9870964b193273efc9
SSDEEP 384:S3DGG3BxSVoESV1CVtVh/VHFa28WTeTAT0TKTgTET0TYTnThTITbTuTFToTUTkTl:SdROo+P3tTTpc
TLSH
T1738274423F584C5BD195EA3274EF8526FBE422AB50422FC4B0ED625497637DAC37E8C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3648	4176	cmd.exe	81
PID 3648 wrote to memory of 948	3648	net.exe	82
PID 4176 wrote to memory of 4376	4176	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WindowsOptimizer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:948
- C:\Windows\system32\reg.exe
  reg add "HKCU\Console" /v WindowAlpha /t REG_DWORD /d 215 /f
  2⤵
  PID:4376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5036