29c116c22dd38b6747f486d01c5568ebe2e14d024acc65533a180e55a4e80236

Analysis

max time kernel
899s
max time network
461s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 10:06

Target
PerformanceOptimizer.bat
Size 5KB
Sample260705-l49ssabw8x
SHA256 29c116c22dd38b6747f486d01c5568ebe2e14d024acc65533a180e55a4e80236
MD5 47b16ab7cb3103835772b012e2ae043f
SHA1 1922915e8c33d2cf5e248233ac653810ffea4209
SHA512 98879e3407bab51d73a66ab1c2b9cd629cbdeb4e679f43af3d431dd37caccda7e25633ed3f8009f943eb3101afb6a6bde2414dbad8015321aaa62ae8dbed4a68
SSDEEP 96:7ujpPHCDnbXeLJ0AVyXBh1yIGQviLlA27DU:KjpPHCryLJ0bwB5A2nU
TLSH
T1F6B163353035E5209653673BDDB2D4A8BA2353FB492A2D04794FC3FA6B411E1F26E784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 5376	3044	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PerformanceOptimizer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\PerformanceOptimizer.bat" hidden
  2⤵
  PID:5376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4768

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:256