176c93b681c4d80e70eb1c5b190ae637b5ac44103359543e9133ad86c443df5b

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 03:30

Target
AffinityLoader_patched.exe
Size 1.9MB
Sample260625-d2vxvahs8j
SHA256 176c93b681c4d80e70eb1c5b190ae637b5ac44103359543e9133ad86c443df5b
MD5 718aaf3ecc7859e46ddfb083a21f41f9
SHA1 bc23e01f5e1c8bb2263e548c0b2ae344778ac5ba
SHA512 bf56204f4b5669db3dbf7fcae18d1cd955cd7dc47d104647d2792dc99f1ba17de554f993c9d03d201fdab3315b4e83a5dd9a729eb3150007cb0ca9418c076a94
SSDEEP 49152:nTcg01tiBBVvAid9WHUd3WnlTdNvR9uZ:s4Fd91g0Z
TLSH
T1E995AE47E2A901ECC567D278C612831BFB7138091B30A7DB26E54BA92F236E05F7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4376	2224	AffinityLoader_patched.exe	87
PID 2224 wrote to memory of 1956	2224	AffinityLoader_patched.exe	88

C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe
"C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe
  "C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe" --w7q4xt2 2224
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe
  "C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe" --w7q4xt2 2224
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1956