5424299639651204b562f7d23c2908d390cca3d40bacf6cd60a8ec139aa5cca9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GoogleOneOfferRunner/检查安装.bat
Size 2KB
Sample261104-x52pcaee63
SHA256 5424299639651204b562f7d23c2908d390cca3d40bacf6cd60a8ec139aa5cca9
MD5 5b0186ec377ec462f6bc339b0fd49946
SHA1 1258936577b5bcc12e07a047a34050690fef38f4
SHA512 bfdf664c79183ae5403d0659943c16d2e4b6a47cfb94587cebd9ffa2f1cc5d153cb1f2cd77e77700a06b2c5694dde6080f7cd638fe1b62762d375da5b5c45430
TLSH
T14A5133A5B46CA18812BD57DC8EB54041F94805CF4561BD92BCEF51F43B863E02AFEA3D
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1800	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3980	1800	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GoogleOneOfferRunner\检查安装.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads