f9cd89f0d1da985a61cc1dc36b6c1970110ac7e66856b7d7a6910d1c30a4b7ea

Analysis

user interaction
yes
max time kernel
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:13

Target
setup.bat
Size 15KB
Sample260701-vrhcfaaz9j
SHA256 f9cd89f0d1da985a61cc1dc36b6c1970110ac7e66856b7d7a6910d1c30a4b7ea
MD5 f2273cd9a2567b1dc5d547e8947bd7ed
SHA1 98c26dbccdb6dd2b8ffe4f669e32edb9b8d37180
SHA512 ac8b4949f15616c604460cd5bf7d7d5e895740acd7c0655e5c115e9251614f1fa9222b52f8bfba2398a98c64c0c0f72190dd9c42b48b6c5f8151ca515152e3d9
SSDEEP 192:JTer9OxKjC15cr4EV4cLEOrq65r1/C4TMaT5GQYR/22q42xS/B:9eri/MhrzBOaTsE2q42x0
TLSH
T1D662B52D3D45281410F30B7AECAFD00AFE56017B512A1050F5AEA2989F789AFD325DBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2096	2716	cmd.exe	89
PID 2716 wrote to memory of 4928	2716	cmd.exe	90
PID 2716 wrote to memory of 4032	2716	cmd.exe	91
PID 2716 wrote to memory of 4024	2716	cmd.exe	92
PID 2716 wrote to memory of 4000	2716	cmd.exe	93
PID 2716 wrote to memory of 3992	2716	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo marco "
  2⤵
  PID:2096
- C:\Windows\System32\findstr.exe
  findstr /C:"polo"
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo marco "
  2⤵
  PID:4032
- C:\Windows\System32\findstr.exe
  findstr /V /C:"polo"
  2⤵
  PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\" "
  2⤵
  PID:4000
- C:\Windows\System32\findstr.exe
  findstr /V /C:"C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3992