f18bb3731970abf451ab4d01aedd9af10abdf697fa35c85ed33a83a3e0891493

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 02:15

Target
f18bb3731970abf451ab4d01aedd9af10abdf697fa35c85ed33a83a3e0891493.exe
Size 53KB
Sample260529-cpybrsbs4x
SHA256 f18bb3731970abf451ab4d01aedd9af10abdf697fa35c85ed33a83a3e0891493
MD5 ee5ea5a0cebf32a5d9dc97f53719b566
SHA1 fb1bc8bc27e34f571c2585c96a7329b2407c1de7
SHA512 d9f9aca0256ca3792974cdb0cc497d12dc881e79e3f6a1e5cf9e1c9cf566c53bf4605d9d6eee5134a4ffcfe0ab1fc6c1536454369cf0f33d1992a497d75165e0
SSDEEP 768:wch4aXxc0BUcbqHeBI3N5CdDXKVMB5ku6bbxldOER5TcdOjCyuZ:Th4Cx5bmC1I05kRbJOERPjcZ
TLSH
T14D336C966B7C04A1E57AD27BC693860AD5F1B8255B62D7CF0360C74A1F333E1E93A312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5332	f18bb3731970abf451ab4d01aedd9af10abdf697fa35c85ed33a83a3e0891493.exe
5332	f18bb3731970abf451ab4d01aedd9af10abdf697fa35c85ed33a83a3e0891493.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5332 wrote to memory of 2892	5332	f18bb3731970abf451ab4d01aedd9af10abdf697fa35c85ed33a83a3e0891493.exe	80

C:\Users\Admin\AppData\Local\Temp\f18bb3731970abf451ab4d01aedd9af10abdf697fa35c85ed33a83a3e0891493.exe
"C:\Users\Admin\AppData\Local\Temp\f18bb3731970abf451ab4d01aedd9af10abdf697fa35c85ed33a83a3e0891493.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_unins_res64.bat" "
  2⤵
  PID:2892

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

_unins_res64.bat

Path C:\Users\Admin\AppData\Local\Temp\_unins_res64.bat
Size 302B
SHA256 6a9019bcf83a2103a50599c5a23bd014edbf991fa65a1800992e9182d333f6b2
MD5 d4f1841f40808c033e58948f6c0cd802
SHA1 44a2dca5e2b9045e7d0949990e31f9472eb87714
SHA512 f5d739bea31506362cfc70fe5a72a0940c2439bc43414e43071408772f2bd133ff073494ad2bbe5cb82ba8c00568f8d80b64dc030cdc8f397c83bff0e2c6db62
TLSH
T1B7E0CD2BD0D6CE791805643A056934CCC275E4BC2ADF27196710C49C26A2C1DE6D5704
MD5 SHA1 SHA512 TLSH

Submit Download