5aac494c1f8c40267344249b23f5d70b904e7101aaadb8161c5af96bbeb2a8a9

Analysis

max time kernel
900s
max time network
326s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 08:44

Target
Iniciar-BSAgent.bat
Size 1KB
Sample260710-knmsmsht51
SHA256 5aac494c1f8c40267344249b23f5d70b904e7101aaadb8161c5af96bbeb2a8a9
MD5 f004c1c6d208246672a26b193851d964
SHA1 d4e7b0fd7d370a315188aab7f5c8b8730f48169d
SHA512 98152e6fce95e920b8bfd1d5d20d81453f8d2f138d06215361123a25c7b8deff9abd44c945003354c2bca68c74b14e10148f27908e6273d396ec77082007d881
TLSH
T160219C3212CC0623B050E28CDE153A83F59637573104298974CF7B954FEC08499FA1F8
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 3996	1544	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Iniciar-BSAgent.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\system32\where.exe
  where javaw
  2⤵
  PID:3996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6000

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1472