69bb12bc393902ccbca1e1f8e01cfe7de3946a2f63b5b15d8be1bd868cb74092

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 19:24

Target
rd/nh/IP配置请使用我.bat
Size 840B
Sample260619-x4seaaa13k
SHA256 69bb12bc393902ccbca1e1f8e01cfe7de3946a2f63b5b15d8be1bd868cb74092
MD5 146d009a057a68b0b108a6055e518cd6
SHA1 48091daf83d7e968072308c7962c487f453b352c
SHA512 ed333dc19c563f72c325043de9658ac26b9fb9fb640212fa37c6729496036d89d82ef8b571e667dc399e7e1275ba15ef023041ac0fdca0b88f0025ea91c5eff3
TLSH
T192018953740D952290F00D02EBBA403DED4DB9C34389BC09782B416C6A867967FAECAD
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 996	4084	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rd\nh\IP配置请使用我.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:996