6b3564276a94f3f1bcd097659ba54fc5adda8364ddc56cf68939061a693e9fa9

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 01:51

Target
External.exe
Size 430KB
Sample260422-b96cfaa141
SHA256 6b3564276a94f3f1bcd097659ba54fc5adda8364ddc56cf68939061a693e9fa9
MD5 cd2f13d39d702dafe17ba9d05e1de551
SHA1 713b23561a3f59f2feee3cf6489ee61694a06c20
SHA512 a3fa491124aad2cc8c4e6247d4fefcd0c16434065c7fdceb42164091bf902ccb401a91f60dfef4b36a754b520771ce9ce07dc5b15c1c4016cea0296f0dfcd1c7
SSDEEP 6144:Oow74sNZfiU5vY5SQRJvVhqTfZvNmrAQnU0pavY9gBnd17ZyhQDrv1nDYY:4744ZfXRtQLNa4nUVg9c17EQP1n
TLSH
T1F3949E41F1B544E9F027A478D5ABBA1BFA353888071096C773E4D9681FF27E05BBA312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2656	External.exe
2656	External.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2336	2656	External.exe	79

C:\Users\Admin\AppData\Local\Temp\External.exe
"C:\Users\Admin\AppData\Local\Temp\External.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2336

memory/2656-0-0x000002CBEF270000-0x000002CBEF31E000-memory.dmp

Download

memory/2656-9-0x000002CBEF270000-0x000002CBEF31E000-memory.dmp

Download