32ef74fd7d7fc623ecd152ec722e30d3b09b0be11e9e45a6e97bf05b13d7d63a

Resubmissions

22/05/2026, 17:19

22/05/2026, 17:18

22/05/2026, 17:13

user interaction
yes
max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 17:13

Target
GalacticShooter.exe
Size 108.5MB
Sample260522-vreljsdw7v
SHA256 32ef74fd7d7fc623ecd152ec722e30d3b09b0be11e9e45a6e97bf05b13d7d63a
MD5 49b4faf4ebe59386b4e5b8219c827747
SHA1 2b0ecbecaa353d045b22aaf23dcfe961ea3e7961
SHA512 f8d5aafdb6ed16ba424a54b630805b8816c9ffc30019b692028312434c1378cff308987154151327f8b770f8f66519f699f8c315e031ef26d1588b8c39026016
SSDEEP 1572864:ZdliIZoDiLOLLWG3ZCNrpwQ6FDQMtOJGuqni:ZdlUOA6GarClDQeOR
TLSH
T15148F01663E111AAD577D138C7AB6203EB72B40723309BDF329C43652F63AE45E7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
4036	GalacticShooter.exe
4036	GalacticShooter.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1708	mspaint.exe
1708	mspaint.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	2240	svchost.exe
Token: SeRestorePrivilege	2240	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4768	2240	svchost.exe	111

C:\Users\Admin\AppData\Local\Temp\GalacticShooter.exe
"C:\Users\Admin\AppData\Local\Temp\GalacticShooter.exe"
1⤵
- Loads dropped DLL
PID:4036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\dashost.exe
  dashost.exe {79bcb78e-95dc-497d-a4b46180d3d32eb6}
  2⤵
  PID:4768