02313f3c1dde07687b810243ac6cce5ac22ac804fd90d41b31d789246d4dbcbc

Analysis

max time kernel
114s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 07:02

Target
AG_2.1.4.1.exe
Size 2.1MB
Sample260623-htt3ssaz4m
SHA256 02313f3c1dde07687b810243ac6cce5ac22ac804fd90d41b31d789246d4dbcbc
MD5 34d0d42351f896bfcc28d1fa15939470
SHA1 049eb8a1c0995ac5004016fcddcb480928c7d846
SHA512 48bf1e742484e66a0536de577a6a6f3f65c0ace79d36182221072cc1f85a8372b9768f59d33e180f5051378a3aae58cd11aab15cc9ee253a363220056956c7ec
SSDEEP 24576:05E4CTWOtaUJU5VRtyB4lWe1Mtn+Spoku7Z5339jBAJaaO4ew9fa39UCZ5lWVYk:0esOaR5VRtyBgTtjSJalba
TLSH
T132A53911FF8659ECC19EC670824687721B35B4CB0B21AAFF459545353E6AAF40FBC2AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1196	4224	AG_2.1.4.1.exe	88
PID 4224 wrote to memory of 636	4224	AG_2.1.4.1.exe	89
PID 636 wrote to memory of 1244	636	cmd.exe	90
PID 4224 wrote to memory of 3796	4224	AG_2.1.4.1.exe	92

C:\Users\Admin\AppData\Local\Temp\AG_2.1.4.1.exe
"C:\Users\Admin\AppData\Local\Temp\AG_2.1.4.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\system32\cmd.exe
  "cmd" /C "color 0A"
  2⤵
  PID:1196
- C:\Windows\system32\cmd.exe
  "cmd" /C mode con: cols=78 lines=30
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\system32\mode.com
    mode con: cols=78 lines=30
    3⤵
    PID:1244
- C:\Windows\system32\cmd.exe
  "cmd" /C cls
  2⤵
  PID:3796