61bd12a88e8a8a612b7341100ca58d9ddb2fa45f46508c0717bfd9495f25c978

Analysis

max time kernel
299s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 01:56

Target
freefn.exe
Size 384KB
Sample260712-ccp5maes4s
SHA256 61bd12a88e8a8a612b7341100ca58d9ddb2fa45f46508c0717bfd9495f25c978
MD5 b7e931f7d22a960627f6a9898d728a9f
SHA1 73aa609d5558cf8cc28c6da7eeac4cab6cdbeea3
SHA512 6e8e6039f7d66c4f84d8ce2f02f23411a4d71c7f2729351668700b12dc93b47693d9a6f9d198b173d6a77564863bc7d9afd05ffa3d6277fd099de4c96756e69c
SSDEEP 6144:MfPHa4q2jOq0Zz67zJhEiLXAXMbAIapO8PoEXUPOUwB1FdAfdwOjkRhjQHnnzpbv:sH0hIfuRpO8w2AOFknnzpvl
TLSH
T132848E45F1A440E9E06BA07896BBF60BE935384D075059CB73E84D942BE37F07BBA742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	freefn.exe
4908	freefn.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3080	4908	freefn.exe	87

C:\Users\Admin\AppData\Local\Temp\freefn.exe
"C:\Users\Admin\AppData\Local\Temp\freefn.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\freefn.exe
  "C:\Users\Admin\AppData\Local\Temp\freefn.exe"
  2⤵
  PID:3080