38b4db9ad8d01c0e4da67c3d216e4a9202c86b3ab02982f4f8f2661b9b1e8df2

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 18:29

Target
run.bat
Size 50B
Sample260525-w5drvahv21
SHA256 38b4db9ad8d01c0e4da67c3d216e4a9202c86b3ab02982f4f8f2661b9b1e8df2
MD5 199aa4240f7ce0f281a8e985dc3238d7
SHA1 85d08ac2f6c3ad2a321e763f5a581cb95e25fdf0
SHA512 c04edf1de69463375c2572a646e601a5a5938935430b3f3bfbe09cfecb03b4829ef9967d9a275f163a0f6b6baee12e99bfa20c8cc8761eaf9bc17ff7b8fbb135
TLSH
T17D9002015C5354947169550540EB5598A80C60D76589598025E6302B5DDB4A16549686
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4292	2264	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python run_interactive.py
  2⤵
  PID:4292