8db2bbfba77ff09b46b285eec3b8c6ce2edc2f610b386af73c0012dc269e4bfb

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 15:37

Target
Dimmi/x64/Release/Spoof/serials checker.bat
Size 3KB
Sample260604-s2vdmsaw2j
SHA256 8db2bbfba77ff09b46b285eec3b8c6ce2edc2f610b386af73c0012dc269e4bfb
MD5 b330674b0d42c5d5a7f6b802803b63e0
SHA1 f659ce303aba9122dad750448f652bad489e3df7
SHA512 971bdaf5de960c51bd257e78e788a1011586295a15fa9cfa47986a07a560908c17596808adb3dcbc40e4bce090217c31bddadde8d270729feb5a3c948f61059e
TLSH
T13A814392B4565027C0F8AEB18B344112F819998746282ECCB83FC2B45FB67D47BFD68D
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2976	756	cmd.exe	88
PID 2976 wrote to memory of 2988	2976	net.exe	89
PID 756 wrote to memory of 2096	756	cmd.exe	90
PID 2096 wrote to memory of 2120	2096	cmd.exe	91
PID 2096 wrote to memory of 4708	2096	cmd.exe	92
PID 756 wrote to memory of 1232	756	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Dimmi\x64\Release\Spoof\serials checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E| cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E"
    3⤵
    PID:2120
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4708
- C:\Windows\system32\choice.exe
  choice /c 12345 /n /m "Select Option: "
  2⤵
  PID:1232