b2fd98078da0ba5340ba0949ce5a6784f8919a35666ea207a4212ddc185ae5d7

Analysis

user interaction
yes
max time kernel
1s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Free Robux.exe.bat
Size 59B
Sample260625-srcqvacy3z
SHA256 b2fd98078da0ba5340ba0949ce5a6784f8919a35666ea207a4212ddc185ae5d7
MD5 2469a803675dab19adffc341fad2bbdd
SHA1 97ce3a51f815a4bc5b858c1723b33b465607d17d
SHA512 b21cce25977d225318796102d3856604c3004a75f097bf4a0e4fd9839a6d019f40252f4abd0a784f3a4af5af8a39583bcc4ffdd45af8c6f10941a463d5bfdfc3
TLSH
T1B7A00215CC042B911C350D1443660B44F316604F10045C815002002574C3F857704001
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4928	4652	cmd.exe	86
PID 4652 wrote to memory of 4644	4652	cmd.exe	87
PID 4652 wrote to memory of 2668	4652	cmd.exe	89
PID 4652 wrote to memory of 1632	4652	cmd.exe	92
PID 4652 wrote to memory of 4440	4652	cmd.exe	94
PID 4652 wrote to memory of 2120	4652	cmd.exe	95
PID 4652 wrote to memory of 4496	4652	cmd.exe	96
PID 4652 wrote to memory of 2356	4652	cmd.exe	97
PID 4652 wrote to memory of 3356	4652	cmd.exe	98
PID 4652 wrote to memory of 4360	4652	cmd.exe	99
PID 4652 wrote to memory of 3520	4652	cmd.exe	100
PID 4652 wrote to memory of 1548	4652	cmd.exe	101
PID 4652 wrote to memory of 3660	4652	cmd.exe	102
PID 4652 wrote to memory of 4572	4652	cmd.exe	103
PID 4652 wrote to memory of 3692	4652	cmd.exe	104
PID 4652 wrote to memory of 4260	4652	cmd.exe	105
PID 4652 wrote to memory of 1832	4652	cmd.exe	106
PID 4652 wrote to memory of 2452	4652	cmd.exe	107
PID 4652 wrote to memory of 3740	4652	cmd.exe	108
PID 4652 wrote to memory of 1960	4652	cmd.exe	109
PID 4652 wrote to memory of 4264	4652	cmd.exe	110
PID 4652 wrote to memory of 2156	4652	cmd.exe	111
PID 4652 wrote to memory of 1664	4652	cmd.exe	112
PID 4652 wrote to memory of 1928	4652	cmd.exe	114
PID 4652 wrote to memory of 1148	4652	cmd.exe	116
PID 4652 wrote to memory of 3688	4652	cmd.exe	117
PID 4652 wrote to memory of 8	4652	cmd.exe	118
PID 4652 wrote to memory of 2408	4652	cmd.exe	119
PID 4652 wrote to memory of 1044	4652	cmd.exe	120
PID 4652 wrote to memory of 2184	4652	cmd.exe	122
PID 4652 wrote to memory of 4760	4652	cmd.exe	146
PID 4652 wrote to memory of 4492	4652	cmd.exe	148
PID 4652 wrote to memory of 2068	4652	cmd.exe	150

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Free Robux.exe.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4644
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2668
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1632
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2120
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4496
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2356
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3356
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3520
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1548
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3660
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4572
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3692
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4260
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2452
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3740
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4264
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2156
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1664
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1928
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1148
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3688
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2408
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1044
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2184
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4760
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2068
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3276
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3232
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3748
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:380
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5116
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:744
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3956
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3444
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1688
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4808
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:864
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5024
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1756
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:536
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2476
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1864
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2588
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2412
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3628
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4100
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5260
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5268
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5368
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5376
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5384
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5392
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5400
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5408
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5416
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5424
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5432
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5452
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5468
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5476
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5484
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5508
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5516
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5524
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5532
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5540
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5548
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5556
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5564
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5572
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5580
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5588
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5596
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5604
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5612
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5620
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5628
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6616
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6824
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6840
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6864
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6876
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6884
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6892
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6900
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6908
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6916
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6924
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6932
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6940
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6948
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6968
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6976
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6984
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6992
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7008
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7016
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7024
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8140
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8160
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8168
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8180
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8568
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8588
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8612

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads