51c6b54a5b498e78765d8a95c065ede84380ec1f0438462baefb82b7e3967bbb

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 13:52

Target
_51c6b54a5b498e78765d8a95c065ede84380ec1f0438462baefb82b7e3967bbb.exe
Size 1.3MB
Sample260630-q6lwysgv21
SHA256 51c6b54a5b498e78765d8a95c065ede84380ec1f0438462baefb82b7e3967bbb
MD5 958f3ce99157d6e0c1396d30f4d82e38
SHA1 e9ff8c25cefa6e137606f64cfdc2a4637b834ce9
SHA512 3613b36c2f1ca45305cf8e2a04a6061200249a8a590ab18ab9645dca6232e28d4029e84fd70d391420014a0cd13fdf4be43ea56f4f5272e4b08a48e00774147e
SSDEEP 24576:1OzLJwUh+blb/V5UCSY7lLbkuEQ/fFT9Ite4YoUuplXUnFyPr0NeSwQz3V:1aL2UhylV5UCvH/044YoUuplXUnEPry3
TLSH
T120558E3AA7A811ACC2B7D17CDE074D13E672704D0361ABEB02D48AA52F53BE15B3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5576	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5376 wrote to memory of 6032	5376	_51c6b54a5b498e78765d8a95c065ede84380ec1f0438462baefb82b7e3967bbb.exe	87
PID 6032 wrote to memory of 4232	6032	cmd.exe	89
PID 6032 wrote to memory of 5524	6032	cmd.exe	90
PID 6032 wrote to memory of 3336	6032	cmd.exe	91
PID 5376 wrote to memory of 4968	5376	_51c6b54a5b498e78765d8a95c065ede84380ec1f0438462baefb82b7e3967bbb.exe	92
PID 4968 wrote to memory of 2280	4968	cmd.exe	94
PID 2280 wrote to memory of 5576	2280	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\_51c6b54a5b498e78765d8a95c065ede84380ec1f0438462baefb82b7e3967bbb.exe
"C:\Users\Admin\AppData\Local\Temp\_51c6b54a5b498e78765d8a95c065ede84380ec1f0438462baefb82b7e3967bbb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\_51c6b54a5b498e78765d8a95c065ede84380ec1f0438462baefb82b7e3967bbb.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\_51c6b54a5b498e78765d8a95c065ede84380ec1f0438462baefb82b7e3967bbb.exe" MD5
    3⤵
    PID:4232
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5524
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5576