5944a133b26ef0facc57dc9bf2f7054fd1d033ad1e2764c0cef9751bd9f46068

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 01:29

Target
START.bat
Size 1KB
Sample260707-bwacvafs8x
SHA256 5944a133b26ef0facc57dc9bf2f7054fd1d033ad1e2764c0cef9751bd9f46068
MD5 9ef228ae41426d77b98f7f30e3fb5eaa
SHA1 cca16def36c0b6c5cdbbb6847c4b39bf48659956
SHA512 664fd77e7587b036bdc84f7e7d69d238c06db50e1012054293a00c604d834788cf31cd08b3cfa632cf4bdd3388f68adbcd7eb6b5cc10dfb588cd83adfa1fe0e8
TLSH
T1C731AB016474D5E0407A42ACD619944BC9C6929F170E18DE307DD0A5AFBDE42ABFBBF8
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 4680	2080	cmd.exe	88
PID 4680 wrote to memory of 2496	4680	net.exe	89
PID 2080 wrote to memory of 6040	2080	cmd.exe	90
PID 2080 wrote to memory of 1236	2080	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\START.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2496
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:6040
- C:\Windows\system32\where.exe
  where python3.10
  2⤵
  PID:1236