8db2bbfba77ff09b46b285eec3b8c6ce2edc2f610b386af73c0012dc269e4bfb

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:37

Target
Dimmi/x64/Release/Spoof/serials checker.bat
Size 3KB
Sample260604-s2vdmsaw2j
SHA256 8db2bbfba77ff09b46b285eec3b8c6ce2edc2f610b386af73c0012dc269e4bfb
MD5 b330674b0d42c5d5a7f6b802803b63e0
SHA1 f659ce303aba9122dad750448f652bad489e3df7
SHA512 971bdaf5de960c51bd257e78e788a1011586295a15fa9cfa47986a07a560908c17596808adb3dcbc40e4bce090217c31bddadde8d270729feb5a3c948f61059e
TLSH
T13A814392B4565027C0F8AEB18B344112F819998746282ECCB83FC2B45FB67D47BFD68D
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4284	4040	cmd.exe	80
PID 4284 wrote to memory of 3236	4284	net.exe	81
PID 4040 wrote to memory of 5112	4040	cmd.exe	82
PID 5112 wrote to memory of 4624	5112	cmd.exe	83
PID 5112 wrote to memory of 4708	5112	cmd.exe	84
PID 4040 wrote to memory of 3724	4040	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Dimmi\x64\Release\Spoof\serials checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E| cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E"
    3⤵
    PID:4624
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4708
- C:\Windows\system32\choice.exe
  choice /c 12345 /n /m "Select Option: "
  2⤵
  PID:3724