4dfc3df414e5e2e8ac3f679d668f5af728e996fef40131722aa87c7f2f3e57b9

Analysis

user interaction
yes
max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 00:08

Target
Bat Using Html Redy To Fuck.bat
Size 1KB
Sample260716-aev3jsgx3k
SHA256 4dfc3df414e5e2e8ac3f679d668f5af728e996fef40131722aa87c7f2f3e57b9
MD5 a275b6b7e61a4ca573817c779c12da4c
SHA1 38efc14efdb0b40c5f05d25fc6074c18b786daf3
SHA512 a83947769da461f82e26da3a6bbd8ac8ef155cd3c44b17617cfd4816f7ef7aada5ddd25c276fcbe7b6e898d7293c0c2df3923dc3e835e53510056976d897ecb5
TLSH
T1142163412E1EDDDCC2C093A428B9F14EE4A748915540CF378944981B7ED43E6DDD32C4
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4420	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2068	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 4420	1368	cmd.exe	88
PID 1368 wrote to memory of 2068	1368	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Bat Using Html Redy To Fuck.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4420
- C:\Windows\system32\taskkill.exe
  taskkill /f /im cmd.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2068