208e161ee57b33f2df68b838fd77cff35917a73db5543d1509419064b8c276f1

Resubmissions

29/05/2026, 15:17

29/05/2026, 15:14

user interaction
yes
max time kernel
50s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 15:14

Target
SapoSOCDV2.exe
Size 317KB
Sample260529-smrzzaev9y
SHA256 208e161ee57b33f2df68b838fd77cff35917a73db5543d1509419064b8c276f1
MD5 7de228f141ebd3197e4b92df5b036d97
SHA1 28d5650074947e9bbf49dd2f9976a8069ee55ecd
SHA512 3b46fee24b0c129f64318aa6e0570055a9f0989ae7e7613fee08089ce929a632e6695d7c3f6f9b8e6ffdcabd2f279376453746dc5a3bf424679259eabbac872c
SSDEEP 6144:3qhtDmeQwCBSRQjSLOjrOTq8nr4wXEym+p3Fxr4tAk0hHbVM39NNiHrmQnHM:2DBQjIOjUtnrhmo3FtnBm3diLmQnH
TLSH
T1D4642291FB9A4AEAEA2950FCA37F5549D0843D2FC3D6A7DB2310D33D250E6E0846D606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2928	405AJ9SL.ex

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2928	2340	SapoSOCDV2.exe	81

C:\Users\Admin\AppData\Local\Temp\SapoSOCDV2.exe
"C:\Users\Admin\AppData\Local\Temp\SapoSOCDV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\405AJ9SL.ex
  "C:\Users\Admin\AppData\Local\Temp\405AJ9SL.ex" /bg /mode wasd
  2⤵
  - Executes dropped EXE
  PID:2928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2392

405AJ9SL.ex

Path C:\Users\Admin\AppData\Local\Temp\405AJ9SL.ex
Size 317KB
SHA256 208e161ee57b33f2df68b838fd77cff35917a73db5543d1509419064b8c276f1
MD5 7de228f141ebd3197e4b92df5b036d97
SHA1 28d5650074947e9bbf49dd2f9976a8069ee55ecd
SHA512 3b46fee24b0c129f64318aa6e0570055a9f0989ae7e7613fee08089ce929a632e6695d7c3f6f9b8e6ffdcabd2f279376453746dc5a3bf424679259eabbac872c
SSDEEP 6144:3qhtDmeQwCBSRQjSLOjrOTq8nr4wXEym+p3Fxr4tAk0hHbVM39NNiHrmQnHM:2DBQjIOjUtnrhmo3FtnBm3diLmQnH
TLSH
T1D4642291FB9A4AEAEA2950FCA37F5549D0843D2FC3D6A7DB2310D33D250E6E0846D606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download