927c2f993a68cdc42d294166ac0e7db8f93464c10afa12a046223166ad6d2204

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 11:41

Target
Weed-Hack-V1/start.bat
Size 2KB
Sample260629-ntvbfsd12m
SHA256 927c2f993a68cdc42d294166ac0e7db8f93464c10afa12a046223166ad6d2204
MD5 c3910eb7d7a6becad0115ba4352dd60d
SHA1 ae86a302dea8b75f526ed467227867abf8ffa103
SHA512 7c4352133f3fd402a6500e0ab460d65e7078ee024069919705e44e8ea39e7282cd54c5dd39dfb34cdc58ccf71cd4cb7ffd765b90bd1756b752ab239c78fa6650
TLSH
T1CC419A8D3E05E03976B4D88B8D384166F737D0E312416E6DB0AB4034DA57B8271FE366
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 6332	2808	cmd.exe	91
PID 6332 wrote to memory of 4316	6332	cmd.exe	92
PID 6332 wrote to memory of 6892	6332	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Weed-Hack-V1\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E| cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E"
    3⤵
    PID:4316
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6892