a625d1ebde0aef0642ae1b2c5d488c62432471795579269bba1a1a9da2d54ecf

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 12:16

Target
WindowsUpdate.exe
Size 127KB
Sample260707-pfk2ashv7s
SHA256 a625d1ebde0aef0642ae1b2c5d488c62432471795579269bba1a1a9da2d54ecf
MD5 c567c670e8f6be2623fdc1c7b4515f22
SHA1 3636713a1a2eb1ef0f450bd2fb70140677807957
SHA512 cceb7e38eb679ccc2f9032c1a24ec71e5df88d4467018be00816ad7c930a7a4cb590eb1cd2566bbf56e614a88ff888fcfa661e42f9f3f7ad061e3bcd2e2bf245
SSDEEP 3072:klmEbvwtlzomuQnxk1CHkWYhC+MHNUGk6WG/o:Qelzo+k1CHkWYhC+MtUG5WGA
TLSH
T155D307C6E2D0A1F4C05ADAB56A8F5E73452A7C87B035706E5B50DFF32FA07609D0A389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1200	WindowsUpdate.exe

C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1200