b4e264dc7bf4ed7807d8e09e67f5cb6ea887ab016458859de7821106081d6eef

Analysis

user interaction
yes
max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/07/2026, 21:49

Target
sample/AppHost.exe
Size 303KB
Sample260708-1ppavsav4w
SHA256 b4e264dc7bf4ed7807d8e09e67f5cb6ea887ab016458859de7821106081d6eef
MD5 7d85bfb28dd45f743c697d4c030c7c76
SHA1 26367ad0db272d851af19f8776a2c91d12fa1c3b
SHA512 fc73b53372c9bf15d7d75dd64cae7aa4c9ce8303c4cbcbc18b34c6dd09f64582443550ed1d3779e0f8a94785f64e5f40e091cc82360475fc123410c38a8b79d8
SSDEEP 6144:KfSFkVKL0m3D6UBCxwSNy7KtohXy8lqBVZFDeP:K6FkcLR3GUxSsUoZRc78
TLSH
T106648D5973A80CF9EC77813DC9564646EA72B8150760DBAF03E0865A9F33690AD3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3748	2240	AppHost.exe	80
PID 3748 wrote to memory of 2360	3748	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\sample\AppHost.exe
"C:\Users\Admin\AppData\Local\Temp\sample\AppHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sample\MicrosoftHost.exe" --daemonized
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Users\Admin\AppData\Local\Temp\sample\MicrosoftHost.exe
    C:\Users\Admin\AppData\Local\Temp\sample\MicrosoftHost.exe --daemonized
    3⤵
    PID:2360