1b6ea706ce072ba1d2349098c69e3dfd3542f2d525d29e30179a5d7ffe45494e

Analysis

user interaction
yes
max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/05/2026, 13:20

Target
hookloader (2).exe
Size 120KB
Sample260505-qlc4bagz21
SHA256 1b6ea706ce072ba1d2349098c69e3dfd3542f2d525d29e30179a5d7ffe45494e
MD5 c4b903506577cc8d4178cafc8ed9b6e3
SHA1 5d4d72aab0b4fc620eef1b8128e1dcb18925e8cb
SHA512 4507489fa800c25c0dee0b0821b0ca6854e68c6e7a93ae6e02558b1ae86d35e31ae0a4aca70f917e6d3d44bd1ba1218a1e593ed04380ed619fd73706516a8580
SSDEEP 768:ZiHHWhvHfJYEvg1CijnsKNoFnH8OAlrwKUJhsA96TRn:ZTvHhmna83+KU596TRn
TLSH
T148C35B4AA36604EDD0F1D17AC9171ED4E672B86847519BCF03A0926A1FB73C06A3FB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	2332	hookloader (2).exe

Executes dropped EXE 1 IoCs

pid	Process
4656	ox_1777987249466.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2740	2332	hookloader (2).exe	85
PID 2332 wrote to memory of 1208	2332	hookloader (2).exe	87
PID 1208 wrote to memory of 4656	1208	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\hookloader (2).exe
"C:\Users\Admin\AppData\Local\Temp\hookloader (2).exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2740
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1777987249466.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\ox_1777987249466.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1777987249466.exe
    3⤵
    - Executes dropped EXE
    PID:4656

ox_1777987249466.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1777987249466.exe
Size 276KB
SHA256 2f660620d2b7277ef3180f8429e35afa7884f1945b73662aa1a38ec3258ea4c3
MD5 1fe91af4eedac6208e1e2a1046962771
SHA1 4340beb5b7a15e9d1d8b1548f98454de49f0f958
SHA512 54a3fd8f9001d0ad240ec541274130c57eb4bea9c4bacb799daeab0fc587a29aa081e473c974b0bc94c575dde5bba6e8a146d92803fb61e9d337d622358f5df2
SSDEEP 3072:/COlajPxi/CVpWD+Xc1q1pgpmegV1w6DHz6J1jab6UdJPU:/3a3Vpasc1qfQmbV1X6JOTdJP
TLSH
T1F4548369EF48AC5AD8F7A8FB3C012A3ED0D0546787F179E684C2097D5A0889F17F6D90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2332-0-0x0000000140000000-0x000000014001E000-memory.dmp

Download

memory/2332-16-0x0000000002070000-0x000000000207C000-memory.dmp

Download

memory/2332-17-0x0000000140000000-0x000000014001E000-memory.dmp

Download