1e4a8738c22d093f1866a732ab56f0523e66dc950e1a7ba04cc7fb15e0b0ff26

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:04

Target
2026-05-27_ab547147ed16978e64ce82493ffcd414_snatch.exe
Size 2.2MB
Sample260527-th5wpsdv4x
SHA256 1e4a8738c22d093f1866a732ab56f0523e66dc950e1a7ba04cc7fb15e0b0ff26
MD5 ab547147ed16978e64ce82493ffcd414
SHA1 1edb06b8e894e97dd0213b59ff552d03f4fce892
SHA512 dacec7fadce6c3f48f2a1c7ab32f017896a24e7946bf1dc276511e27467b4a79cd5ad655944b1dfe2df5169943a2b45b425c41fc2f0444298aabb42c4d86cf4f
SSDEEP 24576:lNcDAZp1DfNYQYKpHFDfKUu4XlXC3X450Lpyb+PAjR4FMiPojRkt4kIj/:lNcDKp1DfNYQdDfKUQI8yKojyFWWy
TLSH
T10BA54907BCA504F9C0AE96728977A5967B61BC480F2123DB2E50F7782FB2BE05D79704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2026-05-27_ab547147ed16978e64ce82493ffcd414_snatch.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4756	956	2026-05-27_ab547147ed16978e64ce82493ffcd414_snatch.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-27_ab547147ed16978e64ce82493ffcd414_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_ab547147ed16978e64ce82493ffcd414_snatch.exe"
1⤵
- Disables RegEdit via registry modification
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\2026-05-27_ab547147ed16978e64ce82493ffcd414_snatch.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-27_ab547147ed16978e64ce82493ffcd414_snatch.exe" --watchdog 956
  2⤵
  PID:4756