a6101e21f97f1be6d4184b69d3434fd6e7949c489c47ba565238ee24d29a7fc4

Analysis

user interaction
yes
max time kernel
64s
max time network
42s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
645465assa45s65d456sa4d1.exe
Size 2.0MB
Sample260415-lskdrad19z
SHA256 a6101e21f97f1be6d4184b69d3434fd6e7949c489c47ba565238ee24d29a7fc4
MD5 8c6b90d5401639ccb53612dd7487139b
SHA1 d75cc26758f79500e7b2f517ce22dc26bd8a1df6
SHA512 94f7219d4b5a25852ed4f47c19d46b203ce9a0de6585fb54ac32e3faa2668c99386b0dcb159163a94ec0d2dfdd17d48266a6a190d5294060dfa1a776a3bc38cb
SSDEEP 49152:FvzkI0YQjHWDDc4yIRbbzpr+CPrCSd4u7NzowWaNO+VXL/SH6eJ8Zxw:9E4yIRbbzpr+CPr/aupfHOIiAi
TLSH
T13495E15B67A401EDC5BBD1BCC6178607E7B270090360A6EB07E4CAA52F13BD56B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1116	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3396	640	645465assa45s65d456sa4d1.exe	81
PID 3396 wrote to memory of 2404	3396	cmd.exe	82
PID 3396 wrote to memory of 2184	3396	cmd.exe	83
PID 3396 wrote to memory of 5080	3396	cmd.exe	84
PID 640 wrote to memory of 4016	640	645465assa45s65d456sa4d1.exe	85
PID 4016 wrote to memory of 4328	4016	cmd.exe	86
PID 4328 wrote to memory of 1116	4328	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\645465assa45s65d456sa4d1.exe
"C:\Users\Admin\AppData\Local\Temp\645465assa45s65d456sa4d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\645465assa45s65d456sa4d1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\645465assa45s65d456sa4d1.exe" MD5
    3⤵
    PID:2404
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2184
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-0-0x0000000140000000-0x000000014051F000-memory.dmp

Download

memory/640-2-0x0000000000930000-0x0000000000961000-memory.dmp

Download

memory/640-3-0x0000000140000000-0x000000014051F000-memory.dmp

Download

memory/640-9-0x0000000000930000-0x0000000000961000-memory.dmp

Download

memory/640-10-0x0000000140000000-0x000000014051F000-memory.dmp

Download

memory/1116-8-0x0000019FCFAE0000-0x0000019FCFB11000-memory.dmp

Download

memory/1116-11-0x0000019FCFAE0000-0x0000019FCFB11000-memory.dmp

Download

memory/2404-1-0x0000028ED3FA0000-0x0000028ED414C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads