4c24e9152551e77dc18165829a623b8c459cae7ef5b530dffdab4c37fd7cdd99

max time kernel
16s
max time network
18s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 13:23

Sharing

Target
notmalware.exe
Size 6.6MB
Sample260705-qm487acx2s
SHA256 4c24e9152551e77dc18165829a623b8c459cae7ef5b530dffdab4c37fd7cdd99
MD5 44ce39fbb53c7fad4b9efccabba043d5
SHA1 15f8e0e1043c7397095df7f66c9b20e184b63fe9
SHA512 83917f890f0b4992cfedd9069272211ee094700db79dc1dfb4ad2d591e8734005aeabe25b423c5436ee3ceef801d34e422a28b679369534d9fdae07fb652ab2a
SSDEEP 49152:dxjyUFYzH2y2I705TeKJlLeR8CLWqBCoNSbjB1aQ/i/rL3Yfg76j/4vleKVK1K6X:dx7OjsEpsknvevbE
TLSH
T1D1663903EC6525E9C0ADE1318A768512BF617C894B3127D72BA0F6283F77BD4ADB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 4756	2852	notmalware.exe	89

C:\Users\Admin\AppData\Local\Temp\notmalware.exe
"C:\Users\Admin\AppData\Local\Temp\notmalware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\notmalware.exe
  C:\Users\Admin\AppData\Local\Temp\notmalware.exe
  2⤵
  PID:4756

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact