927c2f993a68cdc42d294166ac0e7db8f93464c10afa12a046223166ad6d2204

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 11:41

Target
Weed-Hack-V1/start.bat
Size 2KB
Sample260629-ntvbfsd12m
SHA256 927c2f993a68cdc42d294166ac0e7db8f93464c10afa12a046223166ad6d2204
MD5 c3910eb7d7a6becad0115ba4352dd60d
SHA1 ae86a302dea8b75f526ed467227867abf8ffa103
SHA512 7c4352133f3fd402a6500e0ab460d65e7078ee024069919705e44e8ea39e7282cd54c5dd39dfb34cdc58ccf71cd4cb7ffd765b90bd1756b752ab239c78fa6650
TLSH
T1CC419A8D3E05E03976B4D88B8D384166F737D0E312416E6DB0AB4034DA57B8271FE366
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 3292	5028	cmd.exe	86
PID 3292 wrote to memory of 3056	3292	cmd.exe	87
PID 3292 wrote to memory of 2672	3292	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Weed-Hack-V1\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E| cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E"
    3⤵
    PID:3056
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2672