028406d40bb9fdb6f9a772e4397719afedfca23f000f89baafc06e7b4bdca0e5

Resubmissions

29/06/2026, 14:02

29/06/2026, 14:01

user interaction
yes
max time kernel
38s
max time network
35s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 14:01

Target
AG_2.2.1.exe
Size 2.1MB
Sample260629-rbpvsse171
SHA256 028406d40bb9fdb6f9a772e4397719afedfca23f000f89baafc06e7b4bdca0e5
MD5 5d36f811445ef0e8e7998d97a620cd42
SHA1 29d13418206ec924a5b0026104f05f8a4ec092c7
SHA512 b664dcae5f6b085065ea721e00a23299f018746e1aed8f6af9afc579a0a4aabd870892ef8364dec5cc4f1d915a158033410c66724c9eeb401a100a87f799c360
SSDEEP 49152:DWbRiqA1bwH6s2DCmPTk8A0QlzCv3YLFJFyb:HAkILFJFy
TLSH
T114A53911FE8659F8C19EC570824687221B35B4CB0B21ABFF559845353F6AAF50FBC2AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 6052	2568	AG_2.2.1.exe	89
PID 2568 wrote to memory of 5916	2568	AG_2.2.1.exe	90
PID 5916 wrote to memory of 6040	5916	cmd.exe	91
PID 2568 wrote to memory of 5920	2568	AG_2.2.1.exe	92
PID 2568 wrote to memory of 4968	2568	AG_2.2.1.exe	93
PID 2568 wrote to memory of 7080	2568	AG_2.2.1.exe	94

C:\Users\Admin\AppData\Local\Temp\AG_2.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\AG_2.2.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\cmd.exe
  "cmd" /C "color 0A"
  2⤵
  PID:6052
- C:\Windows\system32\cmd.exe
  "cmd" /C mode con: cols=78 lines=30
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\mode.com
    mode con: cols=78 lines=30
    3⤵
    PID:6040
- C:\Windows\system32\cmd.exe
  "cmd" /C cls
  2⤵
  PID:5920
- C:\Windows\system32\cmd.exe
  "cmd" /C cls
  2⤵
  PID:4968
- C:\Windows\system32\cmd.exe
  "cmd" /C cls
  2⤵
  PID:7080