3cbd58ce7473b36e227761aed25b7164e2fc819f61ea7de7e68bec73f5fe5a0b

Analysis

max time kernel
112s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 18:51

Target
Celex.exe
Size 1.4MB
Sample260715-xhp22act4l
SHA256 3cbd58ce7473b36e227761aed25b7164e2fc819f61ea7de7e68bec73f5fe5a0b
MD5 9efe4f23484b936ae48dc376b17bf81e
SHA1 2b57a2b8803b2b551c1944dc73560a9764c4d7c3
SHA512 e3be8d822204490825ff475e34ffb85dc8ced4f9cf026cbc266f128560b8b2aa50cdc149733c3465c5389db232cd12297add64b410d21c444894ba1867ecd3c6
SSDEEP 24576:Y4cpKRRM4UBGMTNACIg6GYoj4oXi432R/RE2Ie4V/bNd2hOHoTkE6n/jC4:KKiB7ACIgRQ4Mube4V/bNd2hOHoTkpnb
TLSH
T12D659E5BA7F400F8D1B7D178C5579A17EB7270080320AAEF13E086952FA3BE16B7A751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4332	2224	Celex.exe	89
PID 4332 wrote to memory of 3728	4332	cmd.exe	90
PID 4332 wrote to memory of 1384	4332	cmd.exe	91
PID 4332 wrote to memory of 2088	4332	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\Celex.exe
"C:\Users\Admin\AppData\Local\Temp\Celex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Celex.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Celex.exe" MD5
    3⤵
    PID:3728
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1384
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2088