0613f71d2d39a8ebfdcab999855db1bbbc9ce5b563e79d148f799d14fb5979fc

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 09:48

Target
Bat2Exe (1).bat
Size 1KB
Sample260620-ls75taft9t
SHA256 0613f71d2d39a8ebfdcab999855db1bbbc9ce5b563e79d148f799d14fb5979fc
MD5 c5e2fafdfa3e73d40c39165e4ce50405
SHA1 05775fcbaff949c54a88ac92a7976ef223bd8feb
SHA512 cf129a994b345b9ff1f9717493b744c5aabf0251379953c0e4ec064c2d367e1bc0d60a9e813f64ec373e5c1868d94aa49dca29e176d9059bf2e591e03538c2a1
TLSH
T1442132A610000E60219A3374BB67091B6D0E9AFF51A72D4DB78B3226CF7A10C11AD0F6
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6304	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 6368	2420	cmd.exe	90
PID 2420 wrote to memory of 6304	2420	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Bat2Exe (1).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\mode.com
  Mode 71,3
  2⤵
  PID:6368
- C:\Windows\system32\timeout.exe
  Timeout /T 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6304