5c8a20e25d6af28851f8f75f9976d267cc981d70908c963c57ea5d10446dbfb9

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 21:34

Target
2026-07-18_aa569ddb5a7c627cd770ded9bf7915db_conti.exe
Size 131KB
Sample260718-1e49bsgs3x
SHA256 5c8a20e25d6af28851f8f75f9976d267cc981d70908c963c57ea5d10446dbfb9
MD5 aa569ddb5a7c627cd770ded9bf7915db
SHA1 2ce1836e176733f3b0877fa2cfe4ebde1c397910
SHA512 ecfe76282b89ba2407d2e36d9bea72e448192eac10f29421f58e15886861d3554c7164c67d167ce89d6910750609042d6d78e10d9e0ef01e9ea2813e81641e66
SSDEEP 1536:m0B2BWTPaizoJcNiqg4dfQDq2rMaMnLJddjVYBn9MxX27crdPIlH5cUXioDuZ+o3:m0B2c506NiiZZm7YdPjiQ
TLSH
T11ED309C5BAC99CEBCA06127884AB8339133DFBD547878B134C3972351E136D0AED765A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/memory/2548-1-0x00007FF6F49D0000-0x00007FF6F49F3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3728	2548	2026-07-18_aa569ddb5a7c627cd770ded9bf7915db_conti.exe	89
PID 3728 wrote to memory of 1636	3728	calc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-18_aa569ddb5a7c627cd770ded9bf7915db_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_aa569ddb5a7c627cd770ded9bf7915db_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1636

memory/2548-0-0x00007FF9253C0000-0x00007FF925623000-memory.dmp

Download

memory/2548-1-0x00007FF6F49D0000-0x00007FF6F49F3000-memory.dmp

Download