Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/04/2026, 23:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe
Resource
win10v2004-20260130-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe
Resource
win11-20260130-en
4 signatures
150 seconds
General
- Target 8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe
- Size 670KB
- Sample260429-3f66esht4x
- SHA256 8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe
- MD5 d79208f17b28d2d37a6b8771a0105934
- SHA1 8cd137c037c0f1b8700c108730258063ea8951e9
- SHA512 c59066c894581d53cf43699d5aacfbb11b1dbaad4bb3a87579f9b34809a547921c0baad8b4d5f7d19fa7a2ff405b9052429760ad09902f165d3b3bfe77ed2987
- SSDEEP 12288:5EgYL8lPQBNoeZ0yg0id7lXblEGkKtl3MeXcxNyJhr/a:Og8EPeENlLlEbC35cxp
- TLSH T169E422E853408795F3F31DFE88BABF1749A8DE16961012E2B2CA712E1EB719D15CD01B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2080 8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2080 8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2080 2476 8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe"C:\Users\Admin\AppData\Local\Temp\8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe"C:\Users\Admin\AppData\Local\Temp\8a578c705312891d553a3a8098eb229d362b03fb01cf4986400603e62af557fe.exe" /script /f "\\.\pipe\AHKNLLNKIEL"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2080
-