2c9fd9ce19f5ec81e4f66352d9129e96ac6f5d4e99eff298c734648971baf3f8

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 10:16

Target
somerandom (2).bat
Size 485B
Sample260622-ma85tsbv2s
SHA256 2c9fd9ce19f5ec81e4f66352d9129e96ac6f5d4e99eff298c734648971baf3f8
MD5 67451c6a4e959f2bd86b8493a1564bfb
SHA1 89d7c7e9649c28b8758507d31540874ea753a302
SHA512 deb87f5f0eae96a51faf0003abfdcf72b22b895f3188229fa240098cdfa7e291bb588452ea5d4311806a6a6aabbdd1f2365f325f3d0beb817ee4a9f9e24cabfd
TLSH
T191F09E123CDD083A3570F35D19BDD42EF14A56B3308A54CDB8F844102F49EBEA42142C
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5660 wrote to memory of 5848	5660	cmd.exe	89
PID 5660 wrote to memory of 4896	5660	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\somerandom (2).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Windows\system32\where.exe
  where py
  2⤵
  PID:5848
- C:\Windows\system32\where.exe
  where python
  2⤵
  PID:4896