6a9d78c22dd7b48591af424e75635ecc6e861c5a99e261fed7fb86b6c201808e

Analysis

user interaction
yes
max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mon caca.bat
Size 4KB
Sample260710-ml72xaax5x
SHA256 6a9d78c22dd7b48591af424e75635ecc6e861c5a99e261fed7fb86b6c201808e
MD5 f6c5b4b02478a10eb026cccddf79517d
SHA1 bd3f3d1c72d50695738478bcc2baac38e14d7552
SHA512 951ed2d218fd27beda6f89d606c9b68ddf49d48db238c57101933fc12791391168e0b9f616fb767671b566731ea24e95c7c65968d2f625db0ca6b98d865c4eb1
SSDEEP 24:Zm8Km8VRq8VrdIq8VKq8VFq8V5q8VzPq8VbqPq8V+q8Vuoq8V1lWhm8G:Q70k7b9PJqPQcoPx
TLSH
T1B3A1F04E282EE252BC8E4B56D3F3F08BB24568DF2BC758C420369462F04D990B1BE47D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Delays execution with timeout.exe 20 IoCs

defense_evasion

pid	Process
3472	timeout.exe
3424	timeout.exe
2356	timeout.exe
424	timeout.exe
4668	timeout.exe
2540	timeout.exe
4908	timeout.exe
2636	timeout.exe
3416	timeout.exe
5356	timeout.exe
2436	timeout.exe
1612	timeout.exe
3328	timeout.exe
1300	timeout.exe
1456	timeout.exe
3376	timeout.exe
2108	timeout.exe
3764	timeout.exe
5828	timeout.exe
1932	timeout.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 5076	2500	cmd.exe	88
PID 2500 wrote to memory of 4148	2500	cmd.exe	89
PID 4148 wrote to memory of 3108	4148	cmd.exe	90
PID 4148 wrote to memory of 4840	4148	cmd.exe	91
PID 4148 wrote to memory of 4900	4148	cmd.exe	92
PID 4148 wrote to memory of 4172	4148	cmd.exe	93
PID 4148 wrote to memory of 2256	4148	cmd.exe	94
PID 4148 wrote to memory of 5732	4148	cmd.exe	95
PID 4148 wrote to memory of 3228	4148	cmd.exe	96
PID 4148 wrote to memory of 4232	4148	cmd.exe	97
PID 4148 wrote to memory of 1744	4148	cmd.exe	99
PID 4148 wrote to memory of 5912	4148	cmd.exe	100
PID 4148 wrote to memory of 4644	4148	cmd.exe	101
PID 4148 wrote to memory of 720	4148	cmd.exe	103
PID 4840 wrote to memory of 5032	4840	cmd.exe	112
PID 5732 wrote to memory of 1208	5732	cmd.exe	113
PID 5912 wrote to memory of 4568	5912	cmd.exe	114
PID 2256 wrote to memory of 5016	2256	cmd.exe	115
PID 1744 wrote to memory of 1548	1744	cmd.exe	116
PID 4232 wrote to memory of 4252	4232	cmd.exe	117
PID 3228 wrote to memory of 968	3228	cmd.exe	118
PID 4644 wrote to memory of 4196	4644	cmd.exe	119
PID 4900 wrote to memory of 4308	4900	cmd.exe	121
PID 4172 wrote to memory of 5212	4172	cmd.exe	120
PID 4840 wrote to memory of 3472	4840	cmd.exe	122
PID 5912 wrote to memory of 2636	5912	cmd.exe	123
PID 2256 wrote to memory of 3328	2256	cmd.exe	124
PID 5732 wrote to memory of 3416	5732	cmd.exe	125
PID 1744 wrote to memory of 1300	1744	cmd.exe	127
PID 4644 wrote to memory of 4908	4644	cmd.exe	126
PID 4172 wrote to memory of 1456	4172	cmd.exe	128
PID 4232 wrote to memory of 5356	4232	cmd.exe	129
PID 3228 wrote to memory of 3424	3228	cmd.exe	130
PID 4900 wrote to memory of 3376	4900	cmd.exe	131
PID 4172 wrote to memory of 2108	4172	cmd.exe	132
PID 3228 wrote to memory of 2356	3228	cmd.exe	133
PID 4232 wrote to memory of 2436	4232	cmd.exe	134
PID 5912 wrote to memory of 3764	5912	cmd.exe	135
PID 4644 wrote to memory of 5828	4644	cmd.exe	136
PID 2256 wrote to memory of 4668	2256	cmd.exe	137
PID 4900 wrote to memory of 1612	4900	cmd.exe	138
PID 5732 wrote to memory of 424	5732	cmd.exe	139
PID 4840 wrote to memory of 2540	4840	cmd.exe	140
PID 1744 wrote to memory of 1932	1744	cmd.exe	141

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mon caca.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\mode.com
  mode con: cols=150 lines=50
  2⤵
  PID:5076
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\mon caca.bat" skip
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\mode.com
    mode con: cols=150 lines=50
    3⤵
    PID:3108
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo SYSTEM ERROR && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:5032
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3472
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2540
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo MEMORY CORRUPT && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:4308
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3376
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1612
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo KERNEL PANIC && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:5212
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1456
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2108
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo SYSTEM FAILURE && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:5016
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3328
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4668
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo CRITICAL ERROR && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:1208
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3416
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:424
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo FATAL EXCEPTION && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:968
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3424
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2356
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo BLUE SCREEN && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:4252
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5356
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2436
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo BOOT FAILURE && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:1548
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1300
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1932
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo DISK ERROR && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5912
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:4568
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2636
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3764
- - C:\Windows\system32\cmd.exe
    cmd /k "color 0C && mode con: cols=150 lines=50 && echo zzezeezezezzzeezze && timeout /t 1 >nul && cls && echo RAM FAILURE && timeout /t 1 >nul && goto BoucleInfinie"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\system32\mode.com
      mode con: cols=150 lines=50
      4⤵
      PID:4196
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4908
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5828
- - C:\Windows\system32\mode.com
    mode con: cols=150 lines=50
    3⤵
    PID:720

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads