1b6ea706ce072ba1d2349098c69e3dfd3542f2d525d29e30179a5d7ffe45494e

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 13:20

Target
hookloader (2).exe
Size 120KB
Sample260505-qlc4bagz21
SHA256 1b6ea706ce072ba1d2349098c69e3dfd3542f2d525d29e30179a5d7ffe45494e
MD5 c4b903506577cc8d4178cafc8ed9b6e3
SHA1 5d4d72aab0b4fc620eef1b8128e1dcb18925e8cb
SHA512 4507489fa800c25c0dee0b0821b0ca6854e68c6e7a93ae6e02558b1ae86d35e31ae0a4aca70f917e6d3d44bd1ba1218a1e593ed04380ed619fd73706516a8580
SSDEEP 768:ZiHHWhvHfJYEvg1CijnsKNoFnH8OAlrwKUJhsA96TRn:ZTvHhmna83+KU596TRn
TLSH
T148C35B4AA36604EDD0F1D17AC9171ED4E672B86847519BCF03A0926A1FB73C06A3FB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3952	1104	hookloader (2).exe	82

C:\Users\Admin\AppData\Local\Temp\hookloader (2).exe
"C:\Users\Admin\AppData\Local\Temp\hookloader (2).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:3952

memory/1104-0-0x0000000140000000-0x000000014001E000-memory.dmp

Download

memory/1104-1-0x0000000140000000-0x000000014001E000-memory.dmp

Download