0b4e0a2047764e7f684296a48354c40d2efc3513fb323760a5f34a813d431628

Analysis

max time kernel
900s
max time network
596s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 15:24

Target
koalahook-main/run.bat
Size 132B
Sample260706-ss86facz2p
SHA256 0b4e0a2047764e7f684296a48354c40d2efc3513fb323760a5f34a813d431628
MD5 1f310a4a6331c7be54ce42076c37c092
SHA1 a4da3b20a4bc0bb735c21ebf8534bf14f92526be
SHA512 3267ddc6602f24fce336f0299b95620d474572760cd3bc3870d392606d1b341d197e20b3dad689bd99393ebd0f63c63ac58cb977fba32cbb571bcc47cec32b6a
TLSH
T155C02B462230707CB65842B4899360B37E15D00332175A01C8CB00F814C00C5326C045
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4044	timeout.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 4044	3244	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\koalahook-main\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:4044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:776

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1668