abb08cc15d9c9dca592f3a86b30cf0fc012f997c0fe699efa5da55e21235dfd7

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 15:17

Target
EKmeow's Starry Overlay.vbs
Size 2KB
Sample260602-spccashz6j
SHA256 abb08cc15d9c9dca592f3a86b30cf0fc012f997c0fe699efa5da55e21235dfd7
MD5 249b94c0c4775fb96ec415c66d55d062
SHA1 6c6121726a45347d24786b5b177c0b78216c3da9
SHA512 778507aa1deb7e1362149386a649f1973b2cbbf577d87619bb4b4895a0149da7825bd1de40a5ccef5380dcf113ce33057787ddcb5092dc462fac6c87b34390f9
TLSH
T1BA41DF85FB255E31FD968165EA47D8DE5B42626B0100DE143EAF4CAC5F0A3B506D50E1
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 4732	1544	WScript.exe	81
PID 4732 wrote to memory of 4764	4732	cmd.exe	83

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EKmeow's Starry Overlay.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\System32\cmd.exe
  cmd /c where node 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\where.exe
    where node
    3⤵
    PID:4764