f6fa2da48bd25c76ed87adefce23801d9c8d5694ef6bfdd3a18e1a281b6c11b1

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 22:23

Target
Main.exe
Size 273KB
Sample260714-2a7dkaey2p
SHA256 f6fa2da48bd25c76ed87adefce23801d9c8d5694ef6bfdd3a18e1a281b6c11b1
MD5 90f9a4d030effc7ebfe23368942e2a62
SHA1 4ae5a0e7e0e6a78ad40ef51a2677fd50abbf3359
SHA512 422c7c18233ca3cb7dd09b680be6b3710c9b501a7626e4716026eeb27859554376557edb03da4681026c634a9606d112b510b4a0959c8b9c6fefdb0f6a6fe780
SSDEEP 6144:YaIdQ7KgL7DRTe2OZnEOzGJHHky4yII8slh:v7KgVTVOZEOIjvPh
TLSH
T11454A43BE753C8B8C1D792B07BC399A0A475FC6A0630B45E02959A227F0BC606FDE5D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4348	3320	Main.exe	89
PID 4348 wrote to memory of 2632	4348	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Main.exe
"C:\Users\Admin\AppData\Local\Temp\Main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2632