3ede8f8f54eb0668f2850e7b2f4ca8915f1d6ae3c3bcc081efa1b7f25b98f166

Analysis

user interaction
yes
max time kernel
150s
max time network
160s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/06/2026, 15:00

Target
FINAL_LOADER.exe
Size 313KB
Sample260601-sdlrlagv71
SHA256 3ede8f8f54eb0668f2850e7b2f4ca8915f1d6ae3c3bcc081efa1b7f25b98f166
MD5 3e1a5b82f82ce40b067956f309403ae6
SHA1 6695c54387c7a1543fbbb3c79436d56b9294f796
SHA512 959978584fc66b2c7aafc991b5765bc6b9821abb59c73c07e7d879f360c471b08d554f2c92caee7eca08677d152ab898f957be1807ab85a37876c420a194e4f2
SSDEEP 6144:BSEXjj9k7cI2pCwm7qKydh6zZ9HSE9garThZsFlk2+DU:B/jm1wm7qKyP6zZb5TDv2+
TLSH
T145647C47BAA565BCD156C034A35796B3BA33B8CE03307DBF12E486302E69D516F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3412	4508	FINAL_LOADER.exe	82
PID 3412 wrote to memory of 3372	3412	net.exe	84
PID 4508 wrote to memory of 4044	4508	FINAL_LOADER.exe	85

C:\Users\Admin\AppData\Local\Temp\FINAL_LOADER.exe
"C:\Users\Admin\AppData\Local\Temp\FINAL_LOADER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3372
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4044

memory/4044-4-0x000002288EFA0000-0x000002288EFA1000-memory.dmp

Download

memory/4508-6-0x00007FF704710000-0x00007FF704765000-memory.dmp

Download

memory/4508-19-0x00007FF704710000-0x00007FF704765000-memory.dmp

Download