d6caa2db448ade090eacb3e67706a97d8ea66e67f62d559c8ab471cc0dfcc196 | Triage™

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
prueba_real.bat
Size 40B
Sample260601-cc635sdx9l
SHA256 d6caa2db448ade090eacb3e67706a97d8ea66e67f62d559c8ab471cc0dfcc196
MD5 e6df2d3c180cc55b42b4bf3852424228
SHA1 89c3830d9b6d1f27aa4ba245920093c2e4744ac1
SHA512 003a5addf4949e306c66a4f7322789ba3882a5ad76873403b34d34724c9e542ba6a54414ba1483031477578ab838f28ee3eeb795116748b6ab0af76f2e49fbff
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://primemetricsa.com/1751517

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2828	mshta.exe
3	2828	mshta.exe
4	2828	mshta.exe
5	2828	mshta.exe
6	2828	mshta.exe
7	2828	mshta.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2828	1820	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\prueba_real.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\mshta.exe
  mshta https://primemetricsa.com/1751517
  2⤵
  - Badlisted process makes network request
  PID:2828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads