f23bac33b4a477efc411ca36b22357505ca86aaebd20e2d075377a2c44fb79b8

Resubmissions

15/06/2026, 02:05

15/06/2026, 02:05

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/06/2026, 02:05

Target
s.bat
Size 701B
Sample260615-ch6dssax5p
SHA256 f23bac33b4a477efc411ca36b22357505ca86aaebd20e2d075377a2c44fb79b8
MD5 711740d3cf19ba4985071dc151bf5b41
SHA1 b7d302ed1e3d2e6584dcca2c77d281fbf7ddbb29
SHA512 2f498d04f236947e85f71c006f5d1f8a6cc7eb92704176d7805cd10837424ffe6486bef5ae9a9d63c54a8049c979ce29013ee79d968925cdeadde916ce2339b7
TLSH
T1BB014437DF95057072116C83F7C9E883760CC029C26C7EA4219B001426AB521DD33DF8
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4820	2388	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\s.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\choice.exe
  choice /c YN /m "Press Y to continue, press N to exit"
  2⤵
  PID:4820