2c40e107f74a9e188ece9888a59d56f1a065b6793e7ad5bbac38802f0faf28ef

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 00:09

Target
-.bat
Size 8KB
Sample260717-afvheaby2s
SHA256 2c40e107f74a9e188ece9888a59d56f1a065b6793e7ad5bbac38802f0faf28ef
MD5 bc2b6e6b67f1404238223a765023e82e
SHA1 c97e80532a9b1867e04c142fc80ba86723244cef
SHA512 5ad8a1012d1e43912c937bae602315ea3628ee5a16ab21f148f5ed14bf98139d50214732d2b0c1e495a4619974e673a1db318c75b4a94d869d9c68f3d1b22fc0
SSDEEP 192:JANV9qC/rHPcmGkk2Tq+Gi/f2pSxNHg1lKnY3wm:JANV9qCzH1q+hDAMYH
TLSH
T19202A4923B219C5125D2217B56392097BC6ED2F60249EFEC749E0024EE0C89BE56F5B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 1204	4136	cmd.exe	89
PID 4136 wrote to memory of 260	4136	cmd.exe	91
PID 4136 wrote to memory of 124	4136	cmd.exe	92
PID 4136 wrote to memory of 2256	4136	cmd.exe	93
PID 4136 wrote to memory of 5400	4136	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\-.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\system32\mode.com
  mode con COLS=68 LINES=26
  2⤵
  PID:1204
- C:\Windows\system32\chcp.com
  chcp
  2⤵
  PID:260
- C:\Windows\system32\find.exe
  find /i "936"
  2⤵
  PID:124
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:2256
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\FLTMC.exe"
  2⤵
  PID:5400