5aac494c1f8c40267344249b23f5d70b904e7101aaadb8161c5af96bbeb2a8a9

Analysis

user interaction
yes
max time kernel
898s
max time network
438s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
10/07/2026, 08:44

Target
Iniciar-BSAgent.bat
Size 1KB
Sample260710-knmsmsht51
SHA256 5aac494c1f8c40267344249b23f5d70b904e7101aaadb8161c5af96bbeb2a8a9
MD5 f004c1c6d208246672a26b193851d964
SHA1 d4e7b0fd7d370a315188aab7f5c8b8730f48169d
SHA512 98152e6fce95e920b8bfd1d5d20d81453f8d2f138d06215361123a25c7b8deff9abd44c945003354c2bca68c74b14e10148f27908e6273d396ec77082007d881
TLSH
T160219C3212CC0623B050E28CDE153A83F59637573104298974CF7B954FEC08499FA1F8
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3216	3480	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Iniciar-BSAgent.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\system32\where.exe
  where javaw
  2⤵
  PID:3216