5068872e9de0a0c39794379e61cee5472a4b9402f78be4f1a31dd243dae7d6b5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 06:20

Target
Chay-Tai-macOSx.cmd
Size 838B
Sample260602-g3rhlaez2w
SHA256 5068872e9de0a0c39794379e61cee5472a4b9402f78be4f1a31dd243dae7d6b5
MD5 8eee917f48574cfb95aeaee904478c81
SHA1 538e049b4a58c3b50207c16bb18baf1f6fe0aab5
SHA512 24e3d3ff2dd872d7539b76ddc5f15c27621d25d10590671c48a8e418b0847e7feaa26ed4879ede7670bd1d9a7e0582d6ec0d91897829e2cd01329d0fbde9bdc3
TLSH
T102011210B48F445805FF9C982328010DE613904F93159EAEB063ECAC2B282DEC3F5CED
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1844	1344	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Chay-Tai-macOSx.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\system32\where.exe
  where powershell.exe
  2⤵
  PID:1844