b03e4598c057734941c47d08ec5d500475a337c80178470b049bf5eb38664d16

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dictionary\更新字典.bat
Size 429B
Sample261027-mzb7dsdc78
SHA256 b03e4598c057734941c47d08ec5d500475a337c80178470b049bf5eb38664d16
MD5 9c8b6ee4b8429b1b778141d89ebc269b
SHA1 506d19f034150b2bfaf1ecb2e096a19df476454d
SHA512 fc40003c0bb5729ace124ff15aba0c6c11f38c485f5eb06788bed354d8bcb8a7a427106efdb7092d99f470c457cae0f87e307f292b9fbd7e58f6d663f01f602d
TLSH
T19BE07D63340BC16721FE4664CD476454B02D0ADF81C22DE574D335E85D9DBD46E9D8C9
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4728	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1088	4728	cmd.exe	85
PID 4728 wrote to memory of 3316	4728	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dictionary\更新字典.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1088
- C:\Windows\system32\where.exe
  where node
  2⤵
  PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads