ab60ec1bf1a2f9afdab0acb53f821a98b88298ed9f3fbba0b903a1c2ab31afc2

Analysis

max time kernel
898s
max time network
397s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/07/2026, 00:59

Target
general (ALT).bat
Size 2KB
Sample260712-bb5m9ady71
SHA256 ab60ec1bf1a2f9afdab0acb53f821a98b88298ed9f3fbba0b903a1c2ab31afc2
MD5 13efb6478ce796a894804ec296b9d04b
SHA1 03f3bebcbcbdfd962051405fe787dc8812965937
SHA512 3e1f1c32ff9aea9d6e67fef1f8636e253d665e5a47ed3acc13dae8de336f04c02eccf8ec3f42ded18d92062c9fe1487dfa78c1380053e197dcd30f6b02a93468
TLSH
T1345148A7E00CCA47F2CEA53EF46FB5607127DCC369D6D802834A59F8DC4EDA9684E494
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 3920	692	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3920

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact