fc14b4b3cd06104931af78216a312eff136b6d2e5cf71e27caf725cf3dc44d26

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 22:07

Target
hookloader.exe
Size 44KB
Sample260703-111s2acy9p
SHA256 fc14b4b3cd06104931af78216a312eff136b6d2e5cf71e27caf725cf3dc44d26
MD5 671d5a9e1291138d14de6e234befeacd
SHA1 00426ab9e9a579f504d45a1fae4d377eaee99893
SHA512 3792e2d9a1dfc5d309516c1ab4ad75426a9bac6d5821bbdafb02261bbaaacc3ece0bdf6d9cf54cbb36df920d5f37f4611ce7532abacb2ed73f55c04dfd5d3a19
SSDEEP 384:2ROZQcjOkBEem2FPRFOcMSWXq+HeuSFVfn/AG30Sa7Y2dwHOfwa3RuZoijtBKYkT:OOZHO2BrnoG3E7YkNwaWRqFiKsoY
TLSH
T1C213E81BDE1B916BD3AD8D78C9434D05DE62BC868BD1B5CF67400DE609B1AD49F3E202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2824	2668	hookloader.exe	89

C:\Users\Admin\AppData\Local\Temp\hookloader.exe
"C:\Users\Admin\AppData\Local\Temp\hookloader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause > nul
  2⤵
  PID:2824