8d19455f133d12a48b53d00f2e0d67918fcedb2891d65afb0d36b5e175c25c37

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 16:19

Target
test.bat
Size 181B
Sample260619-tsszwsax71
SHA256 8d19455f133d12a48b53d00f2e0d67918fcedb2891d65afb0d36b5e175c25c37
MD5 6c3607a9fd7618d5e3ce62c1f0e0cd44
SHA1 57e3cb8eccf22af5f1c809d12934c7562596c803
SHA512 f498dd5b4f0da33b4974980f9962afdbdf51b1f876daeaca6fc111be35660d78cd3addb5dbfe523b4d166e383757ce35af69ba528b143b7bc81019f8909e7b77
TLSH
T1FFC0806F4C4788C34E458955237E770D950710575593F1D07C33503195C5955513303F
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4428	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 884	4832	cmd.exe	89
PID 4832 wrote to memory of 4428	4832	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\system32\curl.exe
  curl -o https://drive.google.com/uc?export=download
  2⤵
  PID:884
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:4428