de79aff7c10dc91698f14500155166b51df48a271a654aa2b920b5d3a3ae7f6b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 00:58

Target
autostart.bat
Size 635B
Sample260623-bbrrdsh13t
SHA256 de79aff7c10dc91698f14500155166b51df48a271a654aa2b920b5d3a3ae7f6b
MD5 bf56a5546f4f26d96224ba356c2b0d32
SHA1 4958015058d8b00032e538d9e7d6c1cb64ea3c12
SHA512 7acd8ff4e38719a5ee3b18cd4e0b0de561c325be38aca0e9e6ce3bf3bd775c4e810dde0e604ee7a814d4fc001add207cc87723e073166f7194956210ef5a02f0
TLSH
T1A4F081577624D807FAF13A11E04E8E972F6A93CB3048CB5A12973061DE5A68DE1793D3
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3980	4168	cmd.exe	85
PID 4168 wrote to memory of 4440	4168	cmd.exe	86
PID 4168 wrote to memory of 3220	4168	cmd.exe	87
PID 4168 wrote to memory of 2372	4168	cmd.exe	88
PID 4168 wrote to memory of 3944	4168	cmd.exe	89
PID 4168 wrote to memory of 960	4168	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\autostart.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /va /f
  2⤵
  PID:3980
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /va /f
  2⤵
  PID:4440
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /va /f
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /va /f
  2⤵
  PID:2372
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /va /f
  2⤵
  PID:3944
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce" /va /f
  2⤵
  PID:960