8e5c491e9adf56712c73365c93ec81a210c60156c9d0249676f206874d39f933

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 23:44

Target
Bat Using Html Redy To Fuck.bat
Size 1KB
Sample260715-3rd9sags7k
SHA256 8e5c491e9adf56712c73365c93ec81a210c60156c9d0249676f206874d39f933
MD5 742b5a42bf68ea366e56dcf082709be9
SHA1 895033778cc09258fbcc535543c32101b74e2e8c
SHA512 7c0f108eddf5f8a1dd7ed74301f777f27a341d307c6400edfac6d7a7deb3c9abf1fe213a51d75232043a83425ead177887ee0720a6e346868d90b4c81a1076a0
TLSH
T1A12163812E0EDED882E093A418B9F14EE49B46D12141CF234A41981B7ED53E2ECE31D4
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4696	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5616	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5616	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4696	4656	cmd.exe	88
PID 4656 wrote to memory of 5616	4656	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Bat Using Html Redy To Fuck.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4696
- C:\Windows\system32\taskkill.exe
  taskkill /f /im cmd.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5616