3d029c620c7dc1edcabbb8a4cbe073f682513137ef6d41cbcd7603c0a4113f90

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/06/2026, 04:31

Target
Void-Tools-v2.0-main/setup.bat
Size 3KB
Sample260629-e5g1tset5q
SHA256 3d029c620c7dc1edcabbb8a4cbe073f682513137ef6d41cbcd7603c0a4113f90
MD5 4bb8de8805c0d92d08f2b740594d8134
SHA1 4a8edad72aada22b1bd6101a4c895ca5c80cc596
SHA512 2dcc4090ab75f5cd7961eef17e567ff513dfdf1012b55a7cf42f6722f9cd7544cde05e4a9d95e133373f2b0eb6e98c8d9da93b39e2e02f3c752f67cf2d0c8d6e
TLSH
T1757166822372C83061FC66DDB78C8712B39B44DB118E25DB343D526C774CB56327EA66
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2408	2992	cmd.exe	81
PID 2992 wrote to memory of 5112	2992	cmd.exe	82
PID 2992 wrote to memory of 4356	2992	cmd.exe	83
PID 2992 wrote to memory of 2376	2992	cmd.exe	84
PID 2376 wrote to memory of 2380	2376	cmd.exe	85
PID 2992 wrote to memory of 1560	2992	cmd.exe	86
PID 2992 wrote to memory of 3776	2992	cmd.exe	87
PID 3776 wrote to memory of 1684	3776	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Void-Tools-v2.0-main\setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\where.exe
  where py
  2⤵
  PID:2408
- C:\Windows\system32\where.exe
  where py
  2⤵
  PID:5112
- C:\Windows\system32\where.exe
  where python
  2⤵
  PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python -c "import sys; print(sys.executable)"
    3⤵
    PID:2380
- C:\Windows\system32\where.exe
  where python3
  2⤵
  PID:1560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 -c "import sys; print(sys.executable)"
    3⤵
    PID:1684

AILog.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt
Size 1KB
SHA256 1ee377d849a18634d3a86a094a151e71ca46728205b8c1f8a49d3abdf6f71103
MD5 558556ade32d6ad7c7c5581e2888d43a
SHA1 e73ced8f053ff9e7f0d9de93e7b42b529b723fba
SHA512 afc3fc503170f4e95c41d2d559e177a4baf486049bed8b083d12ad6d25680977a5b3ae67ca99676da8d096854335008aa56847183a9adf5c7bd427233fc479ed
TLSH
T14011CC0206F0C03327998A4F77FB77E44A150B079A80E06C33140E9A0B259EB23FC8A2
MD5 SHA1 SHA512 TLSH

Submit Download