97a77202b83844706847df6954fcec44b27e109ca087be97403810326191f185

Analysis

max time kernel
300s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 17:23

Target
Beware/bomb.bat
Size 1KB
Sample260619-vx51pabs2x
SHA256 97a77202b83844706847df6954fcec44b27e109ca087be97403810326191f185
MD5 41319256648a99fb13f87f11965e25db
SHA1 6219b03fdb9d40f8cb46173289eae5dd6c490237
SHA512 69000aef9d94a603bb3a82282aa3dbee20f739386d960a06345f1885f2da879ebc125f2f7cf3eb195ef3235a65daa80ba804ff977cfb633bb8518f1238b751eb
TLSH
T15821120C78C609219FA128217D3EE3C1B44648C78868EEEDA43B1228A0968F830ED057
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
432	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5472 wrote to memory of 5168	5472	cmd.exe	89
PID 5472 wrote to memory of 5368	5472	cmd.exe	90
PID 5472 wrote to memory of 432	5472	cmd.exe	91
PID 5472 wrote to memory of 2628	5472	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Beware\bomb.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5168
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies registry class
  PID:5368
- C:\Windows\system32\timeout.exe
  timeout /t 300
  2⤵
  - Delays execution with timeout.exe
  PID:432
- C:\Windows\system32\cmd.exe
  cmd /k dir /s
  2⤵
  PID:2628