a836f7c345ce2a13f37500997d7772c5e856fbe5ebf687e96924624d087e2f24

Analysis

user interaction
yes
max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 09:46

Target
test.bat
Size 4KB
Sample260623-lr3tpsb12x
SHA256 a836f7c345ce2a13f37500997d7772c5e856fbe5ebf687e96924624d087e2f24
MD5 671dea000983f790ac6fa6950ca705e1
SHA1 c0ed0ddf8a25bc5c1cd5586fe8925670ff79da01
SHA512 fc75b0434ccb8da3d142d23f922c62ad375ac1aea2718af866d3605e7adaeea5e903af3ff98a7e88867595fab492fb22940a4bf60cb8e5c2a86245fd6c5cc038
SSDEEP 96:82y2XJXwXuXOXHXUlVrJ0mSZRqjZw9/cvlaf1R4RDDSgehGiSC43jMnOn3U:7yFXUzyWvlaH43QOn3U
TLSH
T1599153225E37C317C7A5E6E1B76A8D0577B286C77441CF02225B508A9497CCB41EB2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 7036	5548	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PcaSvc"
  2⤵
  PID:7036