65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f

Analysis

max time kernel
40s
max time network
41s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f.exe
Size 2.8MB
Sample260713-vx83caew9x
SHA256 65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f
MD5 3b483dce1793ec320b176f90492e1731
SHA1 c2ca3ffb1274c7c5898e84bac2e52e75d317cbb2
SHA512 e82171f4e8ee64c2947f7103698ccfe2a2d3aebdea95f12afeaf5c488f4d2280094c4d1a359ec4f97830b89ed5bf29a9c9cc1b74f476faf7d2615bfd2e4708d8
SSDEEP 24576:Tvf8RTEKbJYZoYS3rFEMOwgPR/r+0OQqQkyn+Y81nAc+Ec0xMkl81sU3Ao1poM7Z:bf8RzbJY7YAPtoQqA8nAbpoM7oq7Hj
TLSH
T141D5F94369DB0DEAEDD27BB861C35335E774FD318A291F2AA704C63129536C4AE1EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4948	jar.exe

Loads dropped DLL 1 IoCs

pid	Process
4948	jar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4948	1196	65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f.exe	87
PID 4948 wrote to memory of 4856	4948	jar.exe	89

C:\Users\Admin\AppData\Local\Temp\65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f.exe
"C:\Users\Admin\AppData\Local\Temp\65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\MyAppTemp\jar.exe
  "C:\Users\Admin\AppData\Local\MyAppTemp\jar.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C mkdir C:\Users\Public\wtoolex\
    3⤵
    PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

jar.exe

Path C:\Users\Admin\AppData\Local\MyAppTemp\jar.exe
Size 23KB
SHA256 334faca6bb849f836d2bfd65927ef4ebd28f23edf0625ed72a5042e53610f802
MD5 06c66b0b85579f1ed41abc1218722dcc
SHA1 4263357941d221ee8389f9b210ec416eaa9083be
SHA512 3b157eb93f99143d17093add42ccc775820c26d1cc6d727e90161bdba3a75bb280cd40a1e7c88086820366f289cebacb0a8a9fb46f442cee5a76c70488d2ecc3
SSDEEP 384:fn8f3l19j/KF5Qd5A0IYieTFhO0Qjb4i/8E9VF0NyJ5p:O1EFOd5OYiUFQjbeEVp
TLSH
T15AB28D53DA900C99EA1746B1B4E5571EE938B796EAE0C3D7132DC1081F117C13BAA3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\MyAppTemp\jli.dll
Size 44KB
SHA256 cb731678656fa5b519e2cfd387e96b61345d2b9ac3152f70a658bbb45c31f90a
MD5 9bbe71a0a0db7c9fecd807b101f9877f
SHA1 ca5249ea81c9fc1a61170a4359d49ec0483501e2
SHA512 225aadfdd40cf0ba2a7296fd8f8d57138c38e6ac5b849bbebb7ff8f544b7be42f27a1a0eb73844953e1ea3c6663719d522b28e1fbfadfd99524134be425ceda7
SSDEEP 768:nhqB/Vphs3PWMb6zD5U79uQxcexOIQTeMwgnsI0G4Sd:no6yD5qyeMwgnslG4
TLSH
T1B6234997335940E4D1B652B985D35E8AE3B178850721A7CF0391D22E2F73BE0B5BEE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.txt

Path C:\Users\Admin\AppData\Local\MyAppTemp\main.txt
Size 300KB
SHA256 b7688e905bb34f54702f51c2b4c894c21db065454fd7ba313a07d66eebb19c9b
MD5 da355160226f4586a94f76841a3a4136
SHA1 061b77f2eb1406f91adb187ae1150aebb923fd88
SHA512 23bfcdb0bbf30d9a4d2445df76e251ccef8fd6aabfb16fa2ffd07f54a7765b4c92465b7a898365f815e2a74014ab325a55e75c7c594e2072c4ba5e570b48a494
SSDEEP 6144:RKj5+u/bD6OZFkb69lVKtBHRGEshnwROlr3MgkXWrQSArfupq7GP:RKjo0D66fEZEnvr3QG0rWpqi
TLSH
T13064233BDFC9461FE05E792C42D3BE54324D19188827691C40AE63E6EB48C9791FCE9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.msi

Path C:\Users\Public\wtoolex\a.msi
Size 2.2MB
SHA256 24ab0bd764e05e65c7c692e521cf049d03b06b49edb7f8efc92c69322f536b8d
MD5 5eb57d75a196b8899ff6b6d387fc7dc2
SHA1 839dad03a35700e9d5000b9132b85c843a5c0d03
SHA512 91e30145a132b6686f13e3d6be57e387a8f27c0888f8198d8f1dd0908e2b64cc31d0aa3278492f3985062520f424a1f73ba65434fbf96b1ea9bbe28e5a71760b
SSDEEP 49152:LTj515OGf/YjlkIwcp1shfRJ8igmIeJVUyDmH1t:LT1HOGf/Yjlk7S0fPhJVUagr
TLSH
T155B523219495803EE6F90E31953F8175ACB8FA2813B6C85DC790990FD9940C1BBF7BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-5-0x00007FF62AF40000-0x00007FF62B09F000-memory.dmp

Download

memory/4948-10-0x0000029B70710000-0x0000029B70768000-memory.dmp

Download

memory/4948-9-0x0000029B706C0000-0x0000029B7070C000-memory.dmp

Download

memory/4948-11-0x0000029B71600000-0x0000029B71602000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads