fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:57

Target
fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b.exe
Size 2.6MB
Sample260719-3z2eaahs5q
SHA256 fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b
MD5 90d4d75858b85c1b9ac32a280c200116
SHA1 88bc60ce8f2dfcdd03febc23c5a31f98c5ac5fc3
SHA512 707853d85860c35e2a55ed34db5441b7ac98160dcee18dccda47716aa6d2700a3555c68517b12e500a1fa912f1488d9452b16a60716ffe864bf4a4a2cfb1aafc
SSDEEP 49152:xHqCj/R80W18hmG+bil+oYtSf6ufR80W18hmG+bil+oYtSf6u:xHqaM9ocSCQM9ocSC
TLSH
T157C51229926592FAFD3780B449429284B966B43283792BFF43E0D7336F137C11E6DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 3328	2412	fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b.exe	90

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3328	2412	fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b.exe	90
PID 2412 wrote to memory of 3328	2412	fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b.exe	90
PID 2412 wrote to memory of 3328	2412	fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b.exe	90
PID 2412 wrote to memory of 3328	2412	fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b.exe	90

C:\Users\Admin\AppData\Local\Temp\fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b.exe
"C:\Users\Admin\AppData\Local\Temp\fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3328

memory/3328-0-0x0000000140000000-0x000000014010E000-memory.dmp

Download