be85d43a50af84de17d180aacc667cffbcc6666ea385435e220918195da3a475

Analysis

max time kernel
149s
max time network
118s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/07/2026, 04:24

Target
run.bat
Size 1KB
Sample260714-e1epxagv2s
SHA256 be85d43a50af84de17d180aacc667cffbcc6666ea385435e220918195da3a475
MD5 b1690f3ccaaebace247aedbf97d0eb60
SHA1 56f9b27472aaa31053bad1cd1b5f845ba40101e7
SHA512 862840f3d10b979845147d1f4dab11608b0d8573c9c1e2c3ed9cc5c66de8779a2afc84217ed74afa990b46a29cd820f11c54863726b4a1a9e814448f5c6ee6ed
TLSH
T18131CC1338850576667D82678EFD02A1B79DC0D300843EE8B9DC51989F4C6E16FF5BCA
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3580	3516	cmd.exe	81
PID 3580 wrote to memory of 2140	3580	net.exe	82
PID 3516 wrote to memory of 3532	3516	cmd.exe	83
PID 3532 wrote to memory of 2744	3532	cmd.exe	84
PID 3516 wrote to memory of 3484	3516	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c where python 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\system32\where.exe
    where python
    3⤵
    PID:2744
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python.exe" -c "import sys; exit(0 if sys.version_info[:2]==(3,10) else 1)"
  2⤵
  PID:3484