1e4857a9f908c1eb0735abc642652bd88b4634631a59e34fd031f41094002aa0

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 22:48

Target
payload.bat
Size 1.1MB
Sample260623-2rb9ragy2k
SHA256 1e4857a9f908c1eb0735abc642652bd88b4634631a59e34fd031f41094002aa0
MD5 fac811c42d106ff1066b7110fb57094e
SHA1 c947d38ef8751dee5787264d1099c67aa9ecd09a
SHA512 afadbad9013af144c1cea9c26a5e5441de976b29fe3340555fd49da65fb5bc8657a98fbc4ba726953f59183b856676506ca2c54f8f394c74b2d3c91695a181f4
SSDEEP 24576:AKLYAWNNeBLSsvn4NV1TIKr+ydMlGauYvucJ10Rsqn/p1drD:JoNx2MZyHuYvs9/rdn
TLSH
T1FC3533981F5D487A00FC0298A1D78E692BBF86F05A94F4EF2AC30E55355F78BB11E427
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 5148	3260	cmd.exe	89
PID 3260 wrote to memory of 3556	3260	cmd.exe	90
PID 3260 wrote to memory of 5864	3260	cmd.exe	91
PID 3260 wrote to memory of 5152	3260	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\payload.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 84
  2⤵
  PID:5148
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 69
  2⤵
  PID:3556
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 77
  2⤵
  PID:5864
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 80
  2⤵
  PID:5152