3ede8f8f54eb0668f2850e7b2f4ca8915f1d6ae3c3bcc081efa1b7f25b98f166

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 15:00

Target
FINAL_LOADER.exe
Size 313KB
Sample260601-sdlrlagv71
SHA256 3ede8f8f54eb0668f2850e7b2f4ca8915f1d6ae3c3bcc081efa1b7f25b98f166
MD5 3e1a5b82f82ce40b067956f309403ae6
SHA1 6695c54387c7a1543fbbb3c79436d56b9294f796
SHA512 959978584fc66b2c7aafc991b5765bc6b9821abb59c73c07e7d879f360c471b08d554f2c92caee7eca08677d152ab898f957be1807ab85a37876c420a194e4f2
SSDEEP 6144:BSEXjj9k7cI2pCwm7qKydh6zZ9HSE9garThZsFlk2+DU:B/jm1wm7qKyP6zZb5TDv2+
TLSH
T145647C47BAA565BCD156C034A35796B3BA33B8CE03307DBF12E486302E69D516F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 4984	2424	FINAL_LOADER.exe	80
PID 4984 wrote to memory of 1976	4984	net.exe	82
PID 2424 wrote to memory of 4340	2424	FINAL_LOADER.exe	83

C:\Users\Admin\AppData\Local\Temp\FINAL_LOADER.exe
"C:\Users\Admin\AppData\Local\Temp\FINAL_LOADER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1976
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4340

memory/2424-6-0x00007FF727170000-0x00007FF7271C5000-memory.dmp

Download

memory/2424-19-0x00007FF727170000-0x00007FF7271C5000-memory.dmp

Download

memory/4340-4-0x000001FB6D530000-0x000001FB6D531000-memory.dmp

Download