384beab556a87a5a30541f7a28861c828e71b074eff2c811566e4af9540e05dd

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 17:34

Target
384beab556a87a5a30541f7a28861c828e71b074eff2c811566e4af9540e05dd.exe
Size 92KB
Sample260511-v5la9abs2m
SHA256 384beab556a87a5a30541f7a28861c828e71b074eff2c811566e4af9540e05dd
MD5 d0e37e8cd6e262b30b4c500534750346
SHA1 c01d6099b39e54740340b915a1998bbbd9b7fe2a
SHA512 9a5601383297b586bbcd3d4f5c7dbc32c874c0afe45b8fa21a3fbf1e02174482977d21e114ca1b233342b1941509e5d48d9f916191e76509f5feee6bd50b8079
SSDEEP 1536:GIaoEe5z60dD2n5/AfMXhQTgEi6y6EJP5L5GWKXq3EAkrq77wg:fhRdD2n5/ACaM6JEJP5L5XCcEzuwg
TLSH
T1AB93D9F4A7D29C8AD55A63BCA6D7C5A1363CFEE086628707051436312B0BED03EDB359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3404	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 556	836	384beab556a87a5a30541f7a28861c828e71b074eff2c811566e4af9540e05dd.exe	87
PID 836 wrote to memory of 556	836	384beab556a87a5a30541f7a28861c828e71b074eff2c811566e4af9540e05dd.exe	87
PID 556 wrote to memory of 1560	556	notepad.exe	88

C:\Users\Admin\AppData\Local\Temp\384beab556a87a5a30541f7a28861c828e71b074eff2c811566e4af9540e05dd.exe
"C:\Users\Admin\AppData\Local\Temp\384beab556a87a5a30541f7a28861c828e71b074eff2c811566e4af9540e05dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\System32\calc.exe
    calc.exe
    3⤵
    - Modifies registry class
    PID:1560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3404

memory/556-1-0x0000022315010000-0x0000022315011000-memory.dmp

Download

memory/556-2-0x0000022315000000-0x0000022315001000-memory.dmp

Download

memory/836-0-0x00007FF7F2DA0000-0x00007FF7F2DBC000-memory.dmp

Download