57e55cdc7194d235926618abb4c26ec36bddc2f2e65fed0bc58a7542b18b8cf2

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 14:06

Target
57e55cdc7194d235926618abb4c26ec36bddc2f2e65fed0bc58a7542b18b8cf2.exe
Size 106KB
Sample260718-relybagw3s
SHA256 57e55cdc7194d235926618abb4c26ec36bddc2f2e65fed0bc58a7542b18b8cf2
MD5 3252e43d4a7cea86009e125d7eff04c1
SHA1 b9f4e7e2703ca5904a87981bb32d8f62d77f7ac0
SHA512 9562af0ab8ea553a6e85975e203ca44f026f6c0b4757eb3ad183f187054e4423ec32042233f0f448bb4ff1c79933c97208b5b4b52b1119d62bae8efcd55cf35e
SSDEEP 1536:F5etMWcKIPXzsSo2JcLO8ag6THH2Shxvkoi6ZanZNniO38tsWSdn9dllrVKq:F5hSy8O8aF2Oxvkh6QZNiOsIHzrVX
TLSH
T1C3B36B57A3E530F8F5778A38C4A20A45D772B8720B619FEF07A446561F23AD18D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 5464	2560	57e55cdc7194d235926618abb4c26ec36bddc2f2e65fed0bc58a7542b18b8cf2.exe	90
PID 5464 wrote to memory of 4592	5464	calc.exe	91

C:\Users\Admin\AppData\Local\Temp\57e55cdc7194d235926618abb4c26ec36bddc2f2e65fed0bc58a7542b18b8cf2.exe
"C:\Users\Admin\AppData\Local\Temp\57e55cdc7194d235926618abb4c26ec36bddc2f2e65fed0bc58a7542b18b8cf2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4592