ea091257c279b7e5db23e677826ed00177975cd359364aca809cc09a12614604

Analysis

user interaction
yes
max time kernel
58s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/06/2026, 17:21

Target
tracex.exe
Size 89KB
Sample260619-vxajsaa191
SHA256 ea091257c279b7e5db23e677826ed00177975cd359364aca809cc09a12614604
MD5 dcb4e0db549d6c057e9057d5dbb4924c
SHA1 831b7d6219e80ee5080d4b6961f9f74d6f6a4aac
SHA512 620a60c17103600b122ec006df0dbc8160687178698969a6cfce97d584c2d5fbf9f7e968f5a65997413911700984e10c835b53d0444e5d96591790e8f09cbd6d
SSDEEP 1536:qLDsFBEmKf6g105wcInjCVGVRAEPjKIspfLSWEo20EC:qLDsFBXKCgy5wtGV0ANZSW9
TLSH
T1BB933A26995500BDD26AD7B4EA925905DB727C870371B7CF53808CDB0F62AD89F3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2736	1128	tracex.exe	91
PID 1128 wrote to memory of 1732	1128	tracex.exe	93

C:\Users\Admin\AppData\Local\Temp\tracex.exe
"C:\Users\Admin\AppData\Local\Temp\tracex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1732