ed929725a1d5797f5bdb62b164173f20a7a9a1952b25cc798ff54755c581c793

Analysis

max time kernel
34s
max time network
34s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:16

Target
boykisser.exe
Size 4.0MB
Sample260701-dssfcsfs5x
SHA256 ed929725a1d5797f5bdb62b164173f20a7a9a1952b25cc798ff54755c581c793
MD5 97800616112921099f8827b43e6487a2
SHA1 83a76fb57dbefe4b4e0f8e7d0a1805d6dd333f47
SHA512 1a5d2a19c710537fc910a0336e64cd6fe77c7dfa56b933dd7cc8eec21576f5409cbbc7c9183b48af1c8d7a7864a73d3f0332d04246a2775b32f7612684d28461
SSDEEP 98304:UIDYgDVludgqDa1zbi6XwxcJXmPWEVEzPMHkHJmCh37TkdzSk:dYqV+Sz26XctTEEyxh37IdzH
TLSH
T1F41633DC6BB83476DE48D4B09AD5921C9CC778928C0BCFAB017D18A6786BF15273F41A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5604	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5604	taskkill.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 5604	4756	boykisser.exe	89

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5604

memory/4756-0-0x00007FF744490000-0x00007FF744A3B000-memory.dmp

Download

memory/4756-1-0x00007FF744490000-0x00007FF744A3B000-memory.dmp

Download