1bd3d30eca57968b519c481fcf59810abdb961032ba685684868ef0b256a7296

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 15:02

Target
1bd3d30eca57968b519c481fcf59810abdb961032ba685684868ef0b256a7296.exe
Size 623KB
Sample260718-seq3pshv6s
SHA256 1bd3d30eca57968b519c481fcf59810abdb961032ba685684868ef0b256a7296
MD5 596d3d7a22c2043fbf5fc8ecae51895b
SHA1 db01bbd74f1bffad1efec184e54f02dffabdf26b
SHA512 48a342bc2f8fc9e8badd306938cfbe8bfbd1c8b4bc016bef5b34325a8e133d35af8e2cce61a0f52d9503bef35ce339833860da83ec2425b660667c40afb94d01
SSDEEP 6144:i+cLPB2dRQxeYu6X0B8avS4h5geh0fLinLo05kfNh54P:i+cL6mevB8avp0fLYj5kfNHK
TLSH
T16FD48E2577E412EAD0B7C13E8AD58BA9F6B2B815033097CB01E441952F1BAE85F3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4944	2748	1bd3d30eca57968b519c481fcf59810abdb961032ba685684868ef0b256a7296.exe	90
PID 4944 wrote to memory of 3316	4944	calc.exe	91

C:\Users\Admin\AppData\Local\Temp\1bd3d30eca57968b519c481fcf59810abdb961032ba685684868ef0b256a7296.exe
"C:\Users\Admin\AppData\Local\Temp\1bd3d30eca57968b519c481fcf59810abdb961032ba685684868ef0b256a7296.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3316