042f006c3d08c362850e07d45556f84e22905e2caf0a461f522276daf1d3a155

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/06/2026, 04:31

Target
Void-Tools-v2.0-main/start.bat
Size 2KB
Sample260629-e5g1tset5q
SHA256 042f006c3d08c362850e07d45556f84e22905e2caf0a461f522276daf1d3a155
MD5 e09d3fe96a1012f2bfffbfbb4d79d389
SHA1 6a37e8ffe50c0a9e05a99dc8a459342e7208724e
SHA512 bd684f6017b8f440884f7e3ad28c41e654a270249b3601d08949275985d83be50e69e7df2f3b9f6078cd1f0bace55b63200cdcd0cfbdf7ec271ad53c7783bae3
TLSH
T13E41D0401262DC6060FE15EC738DCB55A39748EB12CA12EF703C819DF74CA5B357D669
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 1892	3680	cmd.exe	81
PID 3680 wrote to memory of 2620	3680	cmd.exe	82
PID 3680 wrote to memory of 1560	3680	cmd.exe	83
PID 3680 wrote to memory of 4568	3680	cmd.exe	84
PID 4568 wrote to memory of 4064	4568	cmd.exe	85
PID 3680 wrote to memory of 4024	3680	cmd.exe	86
PID 3680 wrote to memory of 1812	3680	cmd.exe	87
PID 1812 wrote to memory of 1852	1812	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Void-Tools-v2.0-main\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\system32\where.exe
  where py
  2⤵
  PID:1892
- C:\Windows\system32\where.exe
  where py
  2⤵
  PID:2620
- C:\Windows\system32\where.exe
  where python
  2⤵
  PID:1560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python -c "import sys; print(sys.executable)"
    3⤵
    PID:4064
- C:\Windows\system32\where.exe
  where python3
  2⤵
  PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 -c "import sys; print(sys.executable)"
    3⤵
    PID:1852

AILog.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt
Size 1KB
SHA256 c3e370909001d7c17a5281d5261fe6a19c6ca60996b142e1451361db2e5fc51d
MD5 552959d50ec7fbf1f3692a00c5359320
SHA1 70c0198d76f59facbc56874e44c2e6e46e1e32cd
SHA512 e6542a0e13363a35a709fe99546f7774b15c9be76116fb31d77f96afe0abd2eb4299ae61c7c5a0a293c12e46497d73c6064b0075f96573205dae4f6cbe3d4a6f
TLSH
T161118C4206F0C0B31795574F77FB77E446141B4B9684E07833051E5A1F255AB27FC8A7
MD5 SHA1 SHA512 TLSH

Submit Download