5f675f6745b46d1977757a0568ab7ed30d62bfcb802690c4ddb95cba12efe394

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/07/2026, 16:49

Target
eden.exe
Size 53.4MB
Sample260701-vbza1scs3w
SHA256 5f675f6745b46d1977757a0568ab7ed30d62bfcb802690c4ddb95cba12efe394
MD5 e10561f2a680da01ad26406a55d384a9
SHA1 54a7e00af38b5b215d89e6529fe79d3b01d78e47
SHA512 ac435e99b5aba92d59ce5e67af246d2c8376fee7d235561a40c694841df09502184c3110f875646d7b74582f88373b2ad57956d02aa0cfd17ce23baa25f282b0
SSDEEP 393216:D8GJwSsDpjhMO14vIARUjoUv2NKFY98+BS1jBiIr0HpdnT8Gl/RTOXgmG0KUmokC:YuYrMOyk1hJJkQ+aKTg
TLSH
T1CFC79D13B6A614AAE4BBC470C7578527EB71788A1B34AADF029462752F37BF05E3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3624	eden.exe
3624	eden.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4312	3624	eden.exe	79

C:\Users\Admin\AppData\Local\Temp\eden.exe
"C:\Users\Admin\AppData\Local\Temp\eden.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\eden.exe
  C:\Users\Admin\AppData\Local\Temp\eden.exe
  2⤵
  PID:4312