44c5a1f0dc1219376b96745fc453ae44c7ce2acec0220e88e29e8b8e9dda281d

Analysis

user interaction
yes
max time kernel
253s
max time network
187s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 00:22

Target
Torrent Downloaded from Glodls.to.txt
Size 237B
Sample260531-apd7saft8t
SHA256 44c5a1f0dc1219376b96745fc453ae44c7ce2acec0220e88e29e8b8e9dda281d
MD5 6f0f399b10783e29cd30d3b91ed37851
SHA1 d36ea8fa8347e1cdd72f9223dc7a4f0bdab156d8
SHA512 78ba47e5b0f00a7140d3cec2baf0dbed5b1025a0c7b41e819cd66f3db3903dbf955bdccf4747c77bde2669a6b0641ed50c97f19210445e2c6cb02df9fe885c4e
TLSH
T1CDD02B4D3F7D602F44685A31600B17FF9537474DB75C8E50D76880480252350C35C5D3
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 3328	4784	cmd.exe	82

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Torrent Downloaded from Glodls.to.txt"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Torrent Downloaded from Glodls.to.txt
  2⤵
  PID:3328

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact