3cc909b37e8e2269d2685a1819aa08eead86c5da241c70888640107f1bf49a71

Analysis

max time kernel
899s
max time network
494s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 21:34

Target
Dontopenthis.bat
Size 969B
Sample260705-1evd5abw3p
SHA256 3cc909b37e8e2269d2685a1819aa08eead86c5da241c70888640107f1bf49a71
MD5 97e08305eb59ec1f8a5262f7cb14a8eb
SHA1 5e0f1b9dfae592eedff92ab1548f7c4b9692de3f
SHA512 2e80835185f93d42860a42d8ab25ba1cd6a8e6def65491ab1ba76879368819bf687a2afcbdfa9cf49e62e91b059424ebe2557662fa2ed0c9241494e2f56adba6
TLSH
T10511D0B73415E4560AE21DB74E3328497A9690830F146F80B1A3D17ECF753D12277AED
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6716	whoami.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 6124	5804	cmd.exe	91
PID 5804 wrote to memory of 6140	5804	cmd.exe	92
PID 6140 wrote to memory of 4884	6140	cmd.exe	93
PID 5804 wrote to memory of 6408	5804	cmd.exe	94
PID 6408 wrote to memory of 6716	6408	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Dontopenthis.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\system32\mode.com
  mode con: cols=110 lines=40
  2⤵
  PID:6124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c hostname
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6408
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:244

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1704