8b1f18c1a8c2bd6203e8e16e3929166e0ed2ffe8ecfb6af4c4867b97a5be4d0a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:27

Target
rage/dependenices/imgui/slate/x64/Release/imgui_tables.obj
Size 546KB
Sample260629-e23hcscz91
SHA256 8b1f18c1a8c2bd6203e8e16e3929166e0ed2ffe8ecfb6af4c4867b97a5be4d0a
MD5 fa670e7d7bd6b2d1ff67a8592e047c7e
SHA1 129853bf8380fe643eb3397aba5dbfc6e5ac3e82
SHA512 c7588900a5099ed97129ec4d8927b978d3a677fe8289c39af95fe0cb15e51815be9d13060d7260ec39fd2beb903fd90018138bddb5b8ff2b69ebed159bb10c09
SSDEEP 12288:jIsLqJLrr6CEPUS3kVuGeiPr7eTeP41gtOHeIa2Jufy:jhqt0a2Jua
TLSH
T10FC4F799E1A0C287D76A59B1C05F033EEC63C4B580A0D652DBFF905FACEC345E4A5DA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6120	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\rage\dependenices\imgui\slate\x64\Release\imgui_tables.obj
1⤵
- Modifies registry class
PID:3124

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact