2e365109f189757eaa491b3cba03bb5470a038c662f6a0f158e306bbbb3353f1

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 15:36

Target
tweekbest.exe
Size 298KB
Sample260528-s19ryaew6y
SHA256 2e365109f189757eaa491b3cba03bb5470a038c662f6a0f158e306bbbb3353f1
MD5 892aeee46893b92a83673808ae3befd9
SHA1 980d2bbd8e6d39b35bab9c0490143780dfd42bbe
SHA512 2862c2999ff52a14d954979628e97c62daf1d290720a24430b49726cc5d875fd4527d3c69dc108de1b39359576625a5aaa89a8b233ac66fbdd041958e171c270
SSDEEP 6144:54M3gH/T0gUvLDI/jfeFhIqyJe5EIcby9wUKsHIR:KwHkoqFsGIeUKs
TLSH
T1CC546D3DA26510FAF97BC579CA538902EF717C4207509ADB27A009962F335E18F3DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2172	764	tweekbest.exe	80

C:\Users\Admin\AppData\Local\Temp\tweekbest.exe
"C:\Users\Admin\AppData\Local\Temp\tweekbest.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2172