c6260cf7a6f2c3b278b1899cfdc5d82d880b8a4c1d05b8798fc18ac24858126f

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260714_41d02d.bat
Size 21KB
Sample260714-pre97afv7x
SHA256 c6260cf7a6f2c3b278b1899cfdc5d82d880b8a4c1d05b8798fc18ac24858126f
MD5 1dd0042e69bac01842b14405edb2e606
SHA1 d1f82b372be560a6815e700acc5bf09abb9167ad
SHA512 a287f9cce450e88cca00a4023e8eb98643faf0ef3fb33d97859f298167add07116c0ea5699dd6ed6ac29e51bbaa9a22ccbf0db55ce2ef73acf6a1fc6b72cecf1
SSDEEP 384:eaNHcmSaHE+aKesMOTXbwU0dHRLLGDIfFA:Te4v
TLSH
T1C0A2BB326440B7750768EC1598B1FC2EA75914E6D2322A40F0DE4DEA6F72DB4FD18EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2544	2428	cmd.exe	88
PID 2428 wrote to memory of 5772	2428	cmd.exe	89
PID 2428 wrote to memory of 5940	2428	cmd.exe	90
PID 5772 wrote to memory of 1092	5772	cmd.exe	91
PID 5772 wrote to memory of 5972	5772	cmd.exe	92
PID 1092 wrote to memory of 4516	1092	cmd.exe	93
PID 1092 wrote to memory of 5152	1092	cmd.exe	94
PID 5972 wrote to memory of 3208	5972	cmd.exe	95
PID 5972 wrote to memory of 5836	5972	cmd.exe	96
PID 5152 wrote to memory of 3348	5152	cmd.exe	97
PID 5152 wrote to memory of 4476	5152	cmd.exe	98
PID 4516 wrote to memory of 856	4516	cmd.exe	99
PID 4516 wrote to memory of 5856	4516	cmd.exe	100
PID 3348 wrote to memory of 3244	3348	cmd.exe	101
PID 3208 wrote to memory of 3132	3208	cmd.exe	102
PID 3348 wrote to memory of 1824	3348	cmd.exe	103
PID 3208 wrote to memory of 5324	3208	cmd.exe	104
PID 5940 wrote to memory of 1308	5940	cmd.exe	105
PID 5940 wrote to memory of 5232	5940	cmd.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        
        PID:856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        
        PID:5856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3348
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        6⤵
        
        PID:3244
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        6⤵
        
        PID:1824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        
        PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
        5⤵
        
        PID:3132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
        5⤵
        
        PID:5324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
      4⤵
      PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat "
    3⤵
    PID:1308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260714_41d02d.bat"
    3⤵
    PID:5232

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads