fd3834f06233d4889d86fe67ccb6c94944590650ca4a5b722660d37a7577777c

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:45

Target
fd3834f06233d4889d86fe67ccb6c94944590650ca4a5b722660d37a7577777c.exe
Size 59KB
Sample260720-b6h3qset61
SHA256 fd3834f06233d4889d86fe67ccb6c94944590650ca4a5b722660d37a7577777c
MD5 3467d772d2f5f25cc007814f39b4ee8e
SHA1 03b5e7c8a4af750dd03347a27c7095c79049fb55
SHA512 dcb30df114bba62a8e3eb1a5970120659edab0dbc1c09f604256c3d056d179d82e50d349353d9606d023d7b3cc72e1da82995f752aa2d6d1a05495c3ea829d10
SSDEEP 768:30V2ILrMcQUQQbzjiuJ9PSevX0AxKruPszjV2MV:32FQUnjPBvXWaszjLV
TLSH
T13C5341E57ED95CC7ED64637C62E9C231273DFAD08A434707A52026321A53FD07EE928A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5920 wrote to memory of 5764	5920	fd3834f06233d4889d86fe67ccb6c94944590650ca4a5b722660d37a7577777c.exe	88
PID 5764 wrote to memory of 3244	5764	calc.exe	90

C:\Users\Admin\AppData\Local\Temp\fd3834f06233d4889d86fe67ccb6c94944590650ca4a5b722660d37a7577777c.exe
"C:\Users\Admin\AppData\Local\Temp\fd3834f06233d4889d86fe67ccb6c94944590650ca4a5b722660d37a7577777c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3244