5c56dcf6bc7f034cde487ea5484696f42127895e758d2d166cab403aaee233d7

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 17:40

Target
AvatarLockpick_v3.0_win_full/GUI fix tool/ALP_UI_Cleaner.bat
Size 1KB
Sample260715-v84xrsdx21
SHA256 5c56dcf6bc7f034cde487ea5484696f42127895e758d2d166cab403aaee233d7
MD5 53d185195f893604ae68fbeef9b2c856
SHA1 9b7dac8fce0c11a999fb712f810513350887b8b5
SHA512 97a41846dad5439d2dfc38a414b0fcf7c80c29273b2b331f493f20958bd31969025eaabf63e3566d9953841270d5988286581361f8ec0d9afa80af546e61975b
TLSH
T15C31CC56B1BDA16116BEC75C0EB680A2FD0A60CF42821E6C7D0FC0794F607C67AF91D4
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4012	4560	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AvatarLockpick_v3.0_win_full\GUI fix tool\ALP_UI_Cleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\mode.com
  mode con: cols=65 lines=18
  2⤵
  PID:4012