c090cda496d84179dddda1bdcd1e660c7e496d65428756ee2f7d7c4c5553ebc6

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 18:12

Target
OpenProxy/Install OpenProxy.cmd
Size 1KB
Sample260620-wtlnbahx3s
SHA256 c090cda496d84179dddda1bdcd1e660c7e496d65428756ee2f7d7c4c5553ebc6
MD5 82c640eb59e2d3ce857adccebd10a044
SHA1 702d82817495353048a0156294588a5fe193de8d
SHA512 b1a0793104bfc7111114542a297b634f925f22634d4c905db1d29cb13e45aa0c3f3bc64ea7bf1d99862f9ab9828dcbfa5fa8bfaabd01ab18059f411560b20aae
TLSH
T16D210E0FB105408890BB8A9CEF720C76D7598CC70A229D52B06720BD1907B820BBE315
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 1212	5976	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OpenProxy\Install OpenProxy.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\system32\more.com
  more "C:\Users\Admin\AppData\Local\Temp\OpenProxy\EULA.txt"
  2⤵
  PID:1212