63f81d9ed85459f0c197266f898111eeb9e0626da2efdd37619c809652be74ae

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 12:43

Target
wparser.exe
Size 10.6MB
Sample260706-pyex1abs7j
SHA256 63f81d9ed85459f0c197266f898111eeb9e0626da2efdd37619c809652be74ae
MD5 eef7fd285199e683dda46dca1719ac7b
SHA1 2abb6532ab90d8785d76c0ae5f860a9436aed672
SHA512 bde24b1f3720feb211a3e2a171564c43bf463e294dffeaa64840c0e290a27d64124a253917d17250c068515c5f304ed0bb43b432ba6ef51cfc194435e4fb470c
SSDEEP 98304:MmqKzLzr4cL5p8xTvjNVGs4CxCOnC/Q+kv5g8:M9KqI/Q5v5g8
TLSH
T1A2B6F85BEB7600D2D4BAC1398653A236FD71385A837467DF9B409A561F22BF0AE3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 944	2736	wparser.exe	89
PID 3984 wrote to memory of 4200	3984	cmd.exe	108
PID 4200 wrote to memory of 2408	4200	wparser.exe	109

C:\Users\Admin\AppData\Local\Temp\wparser.exe
"C:\Users\Admin\AppData\Local\Temp\wparser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Users\Admin\Desktop\wparser.exe
  C:\Users\Admin\Desktop\wparser.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2408