05106b965871b7124d9c81000981e5f7b2972b388837dc74082c4fc79da5a74a

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 12:30

Target
wparser.exe
Size 10.6MB
Sample260706-ppfg6sfs21
SHA256 05106b965871b7124d9c81000981e5f7b2972b388837dc74082c4fc79da5a74a
MD5 8044baa7156810b3541dff17d6dfff9b
SHA1 a3b75074b9556e8a2430237364391ce8d3ea58d5
SHA512 07f28ce0d31a1d6544d3ca79aae0e2e94a9cbced09747daf90de990811379727bce727c5afaf956da533438d853e442b83059d24fb1121d772ef8511dbf1be47
SSDEEP 98304:MmqKzLzr4cL5p8xTvjNVDs4CxCTnC/Q+kv5g8:M9Nqz/Q5v5g8
TLSH
T1B3B6F85BEB7600D2D4BAC1398653A236FD71385A837467DF9B409A561F22BF0AE3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1680	1380	wparser.exe	86

C:\Users\Admin\AppData\Local\Temp\wparser.exe
"C:\Users\Admin\AppData\Local\Temp\wparser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1680