3a90d29966ce3a90c39b1c95999d4b77bee90c9b5c52f823f4cdf06037cc3cae

Analysis

max time kernel
24s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.bat
Size 192B
Sample260727-phj7sastev
SHA256 3a90d29966ce3a90c39b1c95999d4b77bee90c9b5c52f823f4cdf06037cc3cae
MD5 3ae23932b011f7bc664c3031bd136e67
SHA1 5e3e80c9fe723bdfe4204c541279cadaa086bcc2
SHA512 44eb2063f0ced2868b607741858a742e7d4b6b8303e8e296521bb2c733d6ec65d1d60e929f8d85492b9041ca65280307ee8109d491c2ada52d1156e388817d2b
TLSH
T111C022D1020880D4730123F70D1BAF4038CF60E588DCF82B2A6310EDB282168820E113
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2424	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 4612	2424	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads