50ce6f1f5f5df76029f26625dd9ad45caf824eb21e9179edf29de4f7e6764fcb

Analysis

max time kernel
149s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 22:34

Target
install.cmd
Size 2KB
Sample260528-2g86qsdy3p
SHA256 50ce6f1f5f5df76029f26625dd9ad45caf824eb21e9179edf29de4f7e6764fcb
MD5 b32973f42d586dba5d027128c8141b98
SHA1 e7dde5644b0ea1611ed395efb2af7da8d034caa0
SHA512 f3af3106b87a062ce061a990736e99569b36c8209bd25a2adeb327e160a70b5831a78594b466bdc3811a4673cc8cd3e80ea75249c62e8225d0465462cb156dd7
TLSH
T1EB517867394281302DE95FD2682AACD7F109C2CF03516F94369DC09D639E2D6B6DF8E2
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 5004	552	cmd.exe	82
PID 552 wrote to memory of 4420	552	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\install.cmd" "
  2⤵
  PID:5004
- C:\Windows\system32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:4420