f9355fa872a8e258d55a3805c7e22d6d9a7f56aceca27afba67aa657c922cc9b

Analysis

max time kernel
118s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 16:20

Target
HACK/HELPERS/system fix.bat
Size 67B
Sample260706-ts5npadt3k
SHA256 f9355fa872a8e258d55a3805c7e22d6d9a7f56aceca27afba67aa657c922cc9b
MD5 5079aeb73a034f7315155b336cda293c
SHA1 09e80f7be773aee16f4f6808372ad5aba742eba6
SHA512 8c139af67163c15c49dcfb037165d50095b57dd6387acc3ab72426a4245c9c20b61ccff00a0f1e3e66a66af09f3526850ee785bfd74e7aaab9778a3acba48974
TLSH
T146A0220C0B88C332C0008BCB320203228CA2A80A2A20A203EC220088A8C023CBE0000A
MD5 SHA1 SHA512 TLSH

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5952 wrote to memory of 6084	5952	cmd.exe	88
PID 6084 wrote to memory of 3516	6084	Dism.exe	89
PID 5952 wrote to memory of 1144	5952	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HACK\HELPERS\system fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Windows\system32\Dism.exe
  DISM /Online /Cleanup-Image /RestoreHealth
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {14C17AC1-56F0-4080-9F5D-C4A87B3F44A1}
    3⤵
    - Drops file in Windows directory
    PID:3516
- C:\Windows\system32\sfc.exe
  sfc /scannow
  2⤵
  PID:1144

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 284KB
SHA256 3c6935f1fbf0123b4016cafd4845d44f241f15b5038d8bb1109075797a95f5e3
MD5 4384a74e819dcfd2be1f8a3a35ad7aa6
SHA1 3d77013b7f2dd7ab74ec48f46c30266df64a7eda
SHA512 3bf8ab44554dc48eca02301217fb596912f671e4156baa7c44e49174545c1dd355a896070d078a0e7bd32091e3a58a71692b5ced8832bacf2a3b584b56d9074b
SSDEEP 1536:QiKPAsRmbXMXtrPT3Sm3DdJ45xRWPzHDU3lv3FB7VKttUf8HDR7abiN+/6Re7OXs:gtX3slbpyZiyjO4fIxqw
TLSH
T1A254DF2E07AB3DB2914984037271AAFD22D77583B7C9F314763FE1696BC25C9CB26640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 288KB
SHA256 2b0fe1c83ad10dce5d59b32c020ea9ba4167a44e022904d7aca1b5d7cfc42c75
MD5 10e9d3bdcab8b3d57840617e37fae87b
SHA1 04e4abba9efaa6c2ea012725d688f7fb610f0546
SHA512 6c10f25bd6b57136e58527c412bc8e207f2b182eba2492408550a540f654685f5f25c0ac09779fee1bd848611058ad9a12801891430571fdb7c7e2d4d981e2d8
SSDEEP 1536:QiKPAsRmbXMXtrPT3Sm3DdJ45xRWPzHDU3lv3FB7VKttUf8HDR7abiN+/6Re7OXl:gtX3slbpyZiyjO4fIxq5
TLSH
T17C54DF2E07AB3DB2914984037271AAFD22D77583B7C9F314763FE16A67C25C9CB26640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download