056411a3ef1c584491bca1cc670b0218a91b1312676f2931f8d10532141cfdcd

Analysis

user interaction
yes
max time kernel
28s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 17:17

Target
0x21 viewbot.exe
Size 9.5MB
Sample260628-vt7ecaat81
SHA256 056411a3ef1c584491bca1cc670b0218a91b1312676f2931f8d10532141cfdcd
MD5 e9f16db0958b3ebbbfa466a40e0446ee
SHA1 137d68857cc0d4cc6aa16e83660c9f472d70cf55
SHA512 c1d40d988fa54c4748855a79dd8dfd470245e24fe10dd09d165ec3184b6c076fb8851bce8b57c88590197c96ae34fa73f2a9e3acc89cafe622e9741d0e59a4e7
SSDEEP 98304:PIv05w/L4VC1hdb0EXrJ2WGILcdYJCZxFie3q47c3byuZ:PfS1h712tILcd5NieB7Ub
TLSH
T174A67B03EC6514E9C1AEA2748AB39262BB757C480B3227D32B90F6347E77BD06D79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 2436	1472	0x21 viewbot.exe	90
PID 1472 wrote to memory of 3980	1472	0x21 viewbot.exe	91

C:\Users\Admin\AppData\Local\Temp\0x21 viewbot.exe
"C:\Users\Admin\AppData\Local\Temp\0x21 viewbot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  PID:2436
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  PID:3980