cafaa78bc02dab035862a0dc75ed2445273dd57ddbfa626e60b4c95d167f987c

Analysis

max time kernel
32s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 22:54

Target
conhost.bat
Size 140B
Sample260602-2vmjwsfz6k
SHA256 cafaa78bc02dab035862a0dc75ed2445273dd57ddbfa626e60b4c95d167f987c
MD5 c38baed65264e3ade873b5fbca3caa43
SHA1 3ffe17f003375918bb282e179f189e9682e84a4a
SHA512 bc85aaaaef525d598713f433ff91305ad2df632a467931f5857c169b5af1001af0abc3e11d50466e644f14ee688c8662f46c7b23521500a9a23dfdc62d8c512d
TLSH
T18AC02B63638B828300D2084245B24C409B5498FB8F002FCC58072198C0BC3B9C3812C5
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 5276	2452	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\conhost.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\system32\cmd.exe
  cmd /v /c "for /l i in () do @start cmd /k color 0a^&title Janela Replicada^&echo [AVISO] Conexao ativa com o chat...^&timeout /t 0 >nul"
  2⤵
  PID:5276