8e5434477cd827d535121307bca3dc3781f7f0615b5fbb78c8d077df0b25c07f

Analysis

user interaction
yes
max time kernel
72s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 19:57

Target
payload.exe
Size 169KB
Sample260705-ypfmlsa19k
SHA256 8e5434477cd827d535121307bca3dc3781f7f0615b5fbb78c8d077df0b25c07f
MD5 f9d92e08fc32e2cf114eed08576ce1e0
SHA1 1c6a6cbe83d5edbfd10f38fb7ca108bad094ab6c
SHA512 cf55c8eae37ec478406abcc4a8aadcf002f81ad037e2b2b6c78988ccf673081b62323b8e997ec99b48fed284f3f447b2419cfa4ea7559321b056a8bab29d5ecb
SSDEEP 3072:VZ/WSEOPQKMA/fSwOWTDYrN6BI0/dRLM5HI+Y6cucY:b4sQKMu7pDYrNYfLuHI+Y6cuc
TLSH
T1FA049E12B69550F9E44BC078C3158972BA7670CA0B2169FF07A402382F5DBFA7F3DA18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	payload.exe
4164	payload.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 2940	4164	payload.exe	90

C:\Users\Admin\AppData\Local\Temp\payload.exe
"C:\Users\Admin\AppData\Local\Temp\payload.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:2940