9c1ee564da975281f5f9d6deb93497a3a389f0908d85b6ab25440f02caebb1d7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 03:58

Target
Decache Exporter/bin/check_size.bat
Size 588B
Sample260602-ejmn7adv4v
SHA256 9c1ee564da975281f5f9d6deb93497a3a389f0908d85b6ab25440f02caebb1d7
MD5 7e99f785f7d3bedc25c2674265656685
SHA1 7603e466852a1f77642273a155de1caaa402e427
SHA512 187643687d938d7dcbb53b6f20c25af081fb4c996fea1b98e708280a708380f1497aa67231b1059b2627c7b29a01f95ab9cfd34c69ec70daa22660f8545fab8e
TLSH
T197F0F6ED441862527CB6CA767901D052F74A581B1101A14C3B9EE6C5AF3635242EA6EA
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 5712	3840	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Decache Exporter\bin\check_size.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /-c /w
  2⤵
  PID:5712