228fc86acbaa6626051fd189932cb1768254aec5a9539771cee8a567103bbec1

Analysis

max time kernel
298s
max time network
276s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/07/2026, 04:17

Target
G_585b2v_windows_amd64.exe
Size 4.0MB
Sample260710-ewdxtacy6p
SHA256 228fc86acbaa6626051fd189932cb1768254aec5a9539771cee8a567103bbec1
MD5 6440dff8fd8156ef54f6814207983d65
SHA1 a1894ecc337c34031986f5908c7300b2483074f6
SHA512 e2ddac21adb3d7987f90d3e78acf7a24df128e639f42544a80c0be6a317de39df7dd44da63cead5c1c3a07c04a8384a8dfda4ce47599536e504f031bb89e9bfd
SSDEEP 49152:ngLyMwzh0jWPh2/UfOQuPY4aJZwUC0SUI3dcg0jnysacR2eYdkT9nwPDC7bODthp:ngz0hi4f6cLp5TFwPD+8th5aE
TLSH
T1D5167C57FCA014F5C0AAA3318976A6527B71BC441F3123DB2B90BAB82F72BD09D79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3560	2796	G_585b2v_windows_amd64.exe	82

C:\Users\Admin\AppData\Local\Temp\G_585b2v_windows_amd64.exe
"C:\Users\Admin\AppData\Local\Temp\G_585b2v_windows_amd64.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  PID:3560

memory/2796-0-0x00007FFD91820000-0x00007FFD91A29000-memory.dmp

Download

memory/2796-1-0x00007FFD918C4000-0x00007FFD918C5000-memory.dmp

Download