8fd83d6a100f636d3c5786ef9eff618d23d4addff1738e383459eae138e2d483

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/06/2026, 16:50

Target
eni_launcher.bat
Size 3KB
Sample260621-vcdqpses2p
SHA256 8fd83d6a100f636d3c5786ef9eff618d23d4addff1738e383459eae138e2d483
MD5 840b152fea54f3091f719c234118808c
SHA1 914e6f356e73efe68a3bd8eb9edf296676564d55
SHA512 429c08dfb3bd21d6a660ca1666ff19385e2680f4094f870c03e2fa2642bc3624dc203e45fdc28ae177b57877084cbf541887ab1a372dd317e7d9c745e3e9d8b9
TLSH
T16A618736390601263488CC5DDA3C5C527618724FF6011D78A09AB2F86FFD785EDFA6B2
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4264	4604	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\eni_launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\system32\where.exe
  where gemini
  2⤵
  PID:4264