4aae3fee319f0f58764e311eb01db88fad9b311471df0e98e96cafa47b8022fb

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 20:04

Target
4aae3fee319f0f58764e311eb01db88fad9b311471df0e98e96cafa47b8022fb.exe
Size 137KB
Sample260719-ythb1aaz5r
SHA256 4aae3fee319f0f58764e311eb01db88fad9b311471df0e98e96cafa47b8022fb
MD5 9e0d11cb756a0799c5e14be32e697c67
SHA1 81da9b8c300d694024a66c62a1010e755ef32b42
SHA512 0cd8fd06907581092b5732c8c4d0d5fc935f3a2204683030f08cc8c23f320165710193a7f73bfc8a38e97ca13c4a5fe8ddb29722e8d842a60ddd920de3d32100
SSDEEP 3072:lxnfLj4tkKL/QP1ti7LmXbzgo1+LjKx3/:z02QQPhrzgMzv
TLSH
T149D36C67B3E530F9E173863985914646E772B83517609BEF03A4476A2F232D09E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4580	4316	4aae3fee319f0f58764e311eb01db88fad9b311471df0e98e96cafa47b8022fb.exe	90
PID 4580 wrote to memory of 2156	4580	calc.exe	91

C:\Users\Admin\AppData\Local\Temp\4aae3fee319f0f58764e311eb01db88fad9b311471df0e98e96cafa47b8022fb.exe
"C:\Users\Admin\AppData\Local\Temp\4aae3fee319f0f58764e311eb01db88fad9b311471df0e98e96cafa47b8022fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:2156