f387b2801e80aa25206acb1bdde83c564946ece458cfc60b6f24c2bd2c074ef9

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 00:39

Target
base.exe
Size 5.4MB
Sample260709-azzw8sa12p
SHA256 f387b2801e80aa25206acb1bdde83c564946ece458cfc60b6f24c2bd2c074ef9
MD5 65d0f1a8b707ead628f97d8f16a757a4
SHA1 9d12c955b9682f6ed51a54375b2716c8ec6bfe93
SHA512 bcfff249f231adf84e0293cb683f41ce1f7ad705766c37f01c927b878937782a4a33641cf42a7bd6eddc16ee59f954c8ad26564a57088fa6ec3bb55717f6229f
SSDEEP 49152:YuPeiu9ryjkRDG7iD2dqET6CefVywtWdy1v3d3MvMTnmWir8yTxPfLoQqpjJIJUD:Yuu1ywRDIBdSnEd23S3PfLwGiz
TLSH
T1FD46CE62AA9C8B4DF026B139C1A3961BA3F1BC0D2321DFCB99D09D774D1F590F56A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3216	base.exe
3216	base.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2900	3216	base.exe	89
PID 3216 wrote to memory of 1396	3216	base.exe	90
PID 1396 wrote to memory of 5780	1396	base.exe	91

C:\Users\Admin\AppData\Local\Temp\base.exe
"C:\Users\Admin\AppData\Local\Temp\base.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\base.exe
  "C:\Users\Admin\AppData\Local\Temp\base.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5780