8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/07/2026, 04:28

Target
8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600.exe
Size 136KB
Sample260713-e32bpaby9j
SHA256 8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600
MD5 ddc93de248d0d7f57d15afd58fc7687d
SHA1 ea48d370d706722fff1279cb566643cbdc10796d
SHA512 9b14aad309266ccee01e3fb1bb548fbd98a1b9475f6b39bf890bb5ee120ef1d51eb8529ab0acda47add93991f07665d0cfb337d0d5064f07e895d8929f1f5fca
SSDEEP 3072:4kgbstv5e1vGPFjWV8EENXPdVvr2wfCymCh:EsB5tIV8Eu1t2wfLmC
TLSH
T16FD36C1B73A630F9E0B38275C8610646E7B3B87217209B5F47A8576A1F232D19D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2156	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1892	1880	8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600.exe	84

C:\Users\Admin\AppData\Local\Temp\8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600.exe
"C:\Users\Admin\AppData\Local\Temp\8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\System32\calc.exe
  C:\\Windows\\System32\\calc.exe
  2⤵
  - Modifies registry class
  PID:1892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2156

memory/1880-1-0x0000022A6A790000-0x0000022A6A791000-memory.dmp

Download

memory/1880-2-0x0000022A6A630000-0x0000022A6A631000-memory.dmp

Download