3d5867708ae5ef66941a18245e345ab45bdb5a158363408313e7cc76285231c4

Analysis

max time kernel
899s
max time network
499s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 21:27

Target
Dontopenthis.bat
Size 1016B
Sample260705-1apyvabw2p
SHA256 3d5867708ae5ef66941a18245e345ab45bdb5a158363408313e7cc76285231c4
MD5 b2952740d6f84e1febd44d7eb76d83bb
SHA1 74e3927bca9fba8b05a765db1e2163b7a478c285
SHA512 54d454f10d3959db363feda4c6941b71f242b0d447492ecb4ad9017ed5a9603913085e1404b2e46caba83462b34466ebef3f6044dfa9f936d9f6448a521bf642
TLSH
T1FB11E1B33411E06616E30DA74E32284A7B9590930B049F84B0A3917ECF753D12277BDD
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3124	whoami.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5356 wrote to memory of 2560	5356	cmd.exe	89
PID 5356 wrote to memory of 1148	5356	cmd.exe	90
PID 1148 wrote to memory of 4644	1148	cmd.exe	91
PID 5356 wrote to memory of 2144	5356	cmd.exe	92
PID 2144 wrote to memory of 3124	2144	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Dontopenthis.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5356
- C:\Windows\system32\mode.com
  mode con: cols=110 lines=40
  2⤵
  PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c hostname
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4652

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:576