7b556a259b0b1a328de6290a92e6a3afdde7a882abcbeb064cc5ac0b11a00e8c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 23:17

Target
7b556a259b0b1a328de6290a92e6a3afdde7a882abcbeb064cc5ac0b11a00e8c.exe
Size 4.7MB
Sample260709-29t8aaby2v
SHA256 7b556a259b0b1a328de6290a92e6a3afdde7a882abcbeb064cc5ac0b11a00e8c
MD5 1ec3fc3e5112b483580f1a7481f5dabd
SHA1 167a454c8f62f0d184d9dfd1b145b2934b60bc26
SHA512 a7885a496a1f0c7b0acab75784ace866579e2400a37d02f5598986dabff49cb993c43db422ac79990276a542ff6387ef9349bfa483d4b8f30bf141512148ed75
SSDEEP 98304:SOoHQM3LYyvbJXDY/evBs4t1Ha5HB+d8MOVdHTvX/0GOL7z0QmY8CJpu6kiURkDU:mnYyXvBs47cs8M2Zq7z0yFV1+
TLSH
T10136F1C069FFA247F3C6B87342709C734C2B598F77A14369FA97A27534486B58A2C607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1224	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1224	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	svchost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 1224	5032	7b556a259b0b1a328de6290a92e6a3afdde7a882abcbeb064cc5ac0b11a00e8c.exe	95

C:\Users\Admin\AppData\Local\Temp\7b556a259b0b1a328de6290a92e6a3afdde7a882abcbeb064cc5ac0b11a00e8c.exe
"C:\Users\Admin\AppData\Local\Temp\7b556a259b0b1a328de6290a92e6a3afdde7a882abcbeb064cc5ac0b11a00e8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1224

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 4.5MB
SHA256 d56de30a8cb10e1bf224e609ea017301770050bd1d87d5f74ba22778d2f80e3c
MD5 8df04e0b2e9dd9692a9036b992ce9c11
SHA1 cfaf4ac7d22be1bb7ce379077e844b9a4d4786b1
SHA512 6ae8cb1700f9014d841300e3d5f3a1791772a6084942fe32432dc0bfa2c13899a890f4660ed4c192b96d4efd27a0139bcc7001ec7ed9e1b509d2a5dfa8f77bd3
SSDEEP 98304:QJ/QNLNChxk1EnGpqUeSMBk7ig9nzGqk/UxrstHgC+6:QeNLNek1VpqUesOYiqfxrstHv+
TLSH
T1F026F047B89000FAD5AAD2348A665662BB713CA50F3157D33B10B7F82F72BE85E39354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-4-0x0000000067700000-0x0000000067ED4000-memory.dmp

Download

memory/1224-14-0x0000000000480000-0x000000000095E000-memory.dmp

Download