5af7218f6c436151685de0ffb87167abf5124e89c0bf135dd188fc7f33b5ef72

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 17:01

Target
5af7218f6c436151685de0ffb87167abf5124e89c0bf135dd188fc7f33b5ef72.exe
Size 125KB
Sample260718-vj2fcabw3y
SHA256 5af7218f6c436151685de0ffb87167abf5124e89c0bf135dd188fc7f33b5ef72
MD5 34ad978d0808893c9cb8f619f88e9b10
SHA1 11234f3e9fbee73ab911876afd2e96035f17d191
SHA512 6131e84d19176ed82e3f0ee20a9079040dd387adcdea411d52877f6f5ae417440e1c3b78591dd24088ab4a59059080d71a02904331060737cb50950bcae67f93
SSDEEP 1536:OMt1YySWmnakaqrDda4B/MVPo6GBmiEfX7Zjun3t7KFfH8wOC4o902sBr:Bt1xSaqrRm6CH8wOC4r
TLSH
T144C32AC5BBC6ACE7CA56123494EB43781338EBC91BC697030D3972391E636D0AE97647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 5460	2484	5af7218f6c436151685de0ffb87167abf5124e89c0bf135dd188fc7f33b5ef72.exe	90
PID 5460 wrote to memory of 1204	5460	calc.exe	92

C:\Users\Admin\AppData\Local\Temp\5af7218f6c436151685de0ffb87167abf5124e89c0bf135dd188fc7f33b5ef72.exe
"C:\Users\Admin\AppData\Local\Temp\5af7218f6c436151685de0ffb87167abf5124e89c0bf135dd188fc7f33b5ef72.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1204

memory/2484-0-0x00007FF747150000-0x00007FF747173000-memory.dmp

Download