26673a45ecd9335be8062d70a20bc303b3bb6f6ad2f6d5c4f4d93d355bb87cb3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
demo.bat
Size 100B
Sample260804-h2zy1sfa87
SHA256 26673a45ecd9335be8062d70a20bc303b3bb6f6ad2f6d5c4f4d93d355bb87cb3
MD5 2b1aa83eea0d99f70ceebc46c1aa52fc
SHA1 a698db0aa01fcb4c06b45b469e2e7767da99cd5d
SHA512 96063c6f6d270384e451a48669c2ca19c842bc18828facc3f55e54a957f124aa37830bfa03e515868cec98ae918275f9eddc6f5c68c2740bf276a45c77689151
TLSH
T10FB09248000D8578F7C143F2B030F506286870381A5B24886C18A2213CAD050435140B
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1456	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 4204	1456	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\demo.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\ryzenadj.exe
  C:\Users\Admin\AppData\Local\Temp\\ryzenadj.exe --stapm-limit=40000 --fast-limit=45000 --slow-limit=45000 --tctl-temp=90
  2⤵
  PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads