e2541a0db19972d6f9a51a03421f6e92307467a0577d795662a1028ef42e045f

Analysis

max time kernel
148s
max time network
90s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 13:08

Target
o.bat
Size 112B
Sample260620-qdgrjae18l
SHA256 e2541a0db19972d6f9a51a03421f6e92307467a0577d795662a1028ef42e045f
MD5 596e43c773ffcf6b7766a28b3957b300
SHA1 7bc2d2c5bea1b8789b8c5ee8283a554cdd325a4f
SHA512 120998455219b492ddc4c57e327623eace53d397ef918ecb8bcf797fffd53cbff0637a984c24196670fdce0b41e30681cb88d4a14950835937bd51499da71848
TLSH
T11CB012534E630B74D017814BFB38CC440879F5D45641C6156458E90378E1D97C1ABD0E
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 5672	2800	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\o.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}" /f
  2⤵
  PID:5672