d4e81a7304049c20e0b606220ff924dc48c70d46a8ab466c97d7c6a896e886f5

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:46

Target
Cs2SkinChanger.exe
Size 11.0MB
Sample260718-b66h2act2p
SHA256 d4e81a7304049c20e0b606220ff924dc48c70d46a8ab466c97d7c6a896e886f5
MD5 234bb25b1878650381668ca32a7254db
SHA1 5aa7cd09afef09c7b3b3bd7c401f776ecab0b18a
SHA512 4bb784e81ab8573e569438e795327fee5e4cc4be90c75d0d17b258e36c468e76df897c40fed1ab175054676f9ea919e11bda43550721abd5399cb23449c37bf7
SSDEEP 49152:KNT7agYvl+bxc+4X6N/wFKZgyRBwD2nIUTKsp:KNT71YMdc+4KFwYZ5IUeW
TLSH
T1C5C633E116E94973E6793FB444F10561EF7B7C9016324ECF26B866881932BC1A63436F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4280	AutoIt3.exe
1756	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 1756	4280	AutoIt3.exe	90

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4280	2024	Cs2SkinChanger.exe	89
PID 4280 wrote to memory of 1756	4280	AutoIt3.exe	90
PID 4280 wrote to memory of 1756	4280	AutoIt3.exe	90
PID 4280 wrote to memory of 1756	4280	AutoIt3.exe	90

C:\Users\Admin\AppData\Local\Temp\Cs2SkinChanger.exe
"C:\Users\Admin\AppData\Local\Temp\Cs2SkinChanger.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Possession.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:1756

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Possession.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Possession.a3x
Size 1.7MB
SHA256 671a2653b7954735aff650833711a6a12888ed3f4df65c84dbc50a59720f9943
MD5 6357b9014f72663ae42e5e72639a5ce5
SHA1 1a34385f62f87c5b8c38f6d2acbf0da684b6de33
SHA512 1f2b522228d560755b66b8dae1f8f01ef7df60469051607f09ab16ac9348260cc0c3576b1e0073e803cf9e38002864230ec139088eb8f3f37d625a00e0a1ad22
SSDEEP 24576:HTyas82DdagLZiI7U+96iEta/hWj+Eay1JVm/a5PFKS3wgRiO5dcz7A6+TR:T2RagLZih7wo+EaO8/aTKS3pRZncol
TLSH
T1A88533E1186DAA71132D3FB914D0A974AFCF290418A34DC6A53A0F84E57CE49D7289FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1756-10-0x0000020C32DD0000-0x0000020C32FF8000-memory.dmp

Download

memory/1756-11-0x0000020C32DD0000-0x0000020C32FF8000-memory.dmp

Download

memory/4280-7-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/4280-8-0x00000253A8900000-0x00000253A8901000-memory.dmp

Download