8bcb382324c759e36b54b5df5a496b03eaf7e7f7977fed47eced2857608baa4c

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 17:28

Target
remover.bat
Size 11KB
Sample260620-v2f75ags3n
SHA256 8bcb382324c759e36b54b5df5a496b03eaf7e7f7977fed47eced2857608baa4c
MD5 b9c375a8bb58cc9e0fe4696152b2d5f5
SHA1 2ab95cb9afd972a16c49a4a3fce7071fdfeaf52c
SHA512 c7615391ce46930898ac187ba39539a5fa62a31de5434093283943229876056e103c291e34c87988685553adb8e8377f9d8c022ee52e9562c56010a72868a762
SSDEEP 192:5mN27dpRMqfKYkmznNKi5WlEk9Nfo2DhXOI7pEqAvTKEhm6zxqC4PANSXfTW:5mEB8qBjNKi5cpXJpEqAvTKEhm6zxqVq
TLSH
T140325603347D457280F129968B5D2103F70A71CB91287F98F0DA42B8BB593526AEEACF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4420	timeout.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4420	2504	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\remover.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\system32\timeout.exe
  timeout /t 4
  2⤵
  - Delays execution with timeout.exe
  PID:4420