d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:08

Target
d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952.exe
Size 1.8MB
Sample260718-eqdd4afy8q
SHA256 d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952
MD5 07f2c7b0eeaa8233a52c7a44b034bb4f
SHA1 047e8e95318424301aa4dac2de28320e7f35eabc
SHA512 f49bfcdefd95291113bcca05840a92b71106eacf211ed8b309da18f5d3fa40e85a21ddac9df11df558b7e25ee56319804a5fecc1c651cd35fae7245a4fbbd562
SSDEEP 24576:LihwrqMYwVyFfHHe+m6Dr2ZnWrxZnG8JsU3Aot+Ec0xMkWd0MzWsLZF:mhyqMY9FfHHewr4WnUd0MzWsLZF
TLSH
T19D95EA83BACB4DE6CAC667B496D343316378FD518B1E5F2F6A08C2316D536C5AD4AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4340	3820	d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952.exe	90
PID 4340 wrote to memory of 4384	4340	calc.exe	91

C:\Users\Admin\AppData\Local\Temp\d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952.exe
"C:\Users\Admin\AppData\Local\Temp\d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4384

memory/3820-0-0x0000000000400000-0x00000000004FF000-memory.dmp

Download