8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 04:28

Target
8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600.exe
Size 136KB
Sample260713-e32bpaby9j
SHA256 8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600
MD5 ddc93de248d0d7f57d15afd58fc7687d
SHA1 ea48d370d706722fff1279cb566643cbdc10796d
SHA512 9b14aad309266ccee01e3fb1bb548fbd98a1b9475f6b39bf890bb5ee120ef1d51eb8529ab0acda47add93991f07665d0cfb337d0d5064f07e895d8929f1f5fca
SSDEEP 3072:4kgbstv5e1vGPFjWV8EENXPdVvr2wfCymCh:EsB5tIV8Eu1t2wfLmC
TLSH
T16FD36C1B73A630F9E0B38275C8610646E7B3B87217209B5F47A8576A1F232D19D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2344	2012	8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600.exe	88
PID 2344 wrote to memory of 4932	2344	calc.exe	89

C:\Users\Admin\AppData\Local\Temp\8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600.exe
"C:\Users\Admin\AppData\Local\Temp\8a87e7a6149bf492126ce679b35fd66d57cc5f5fc4d48f5959351c08738f9600.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\System32\calc.exe
  C:\\Windows\\System32\\calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4932

memory/2012-1-0x0000022572BA0000-0x0000022572BA1000-memory.dmp

Download