d938ef18d15911583674e39a09aa5f58e5f40cedb90491b29745852f8b5c0c06

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:45

Target
d938ef18d15911583674e39a09aa5f58e5f40cedb90491b29745852f8b5c0c06.exe
Size 13KB
Sample260720-c8xvcacz4r
SHA256 d938ef18d15911583674e39a09aa5f58e5f40cedb90491b29745852f8b5c0c06
MD5 205a7fd1f1b2c4ab1b9ff575a0bf93eb
SHA1 5b599888b2cb2ab8d29f8ed1822dd02bc62d7aba
SHA512 a894caa331eaac6cfb30901f6c22be3c2d62ac562eb20e80ccee0b335ea47521ad75d24cb62c4429c8c40b4ffe02dfc3df28b44634bcb3dde2280eeb16354539
SSDEEP 192:y8E6tYnFBc/4hNNr/EYBiudIUA3Q5tfFLZT:y8EsYFBa4hLEO9g3
TLSH
T199524A49FF574CFAE661433DE0732916B076F631977116DB4B61A0511C226D0EDBB2C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1028	4464	d938ef18d15911583674e39a09aa5f58e5f40cedb90491b29745852f8b5c0c06.exe	90
PID 1028 wrote to memory of 4072	1028	calc.exe	91

C:\Users\Admin\AppData\Local\Temp\d938ef18d15911583674e39a09aa5f58e5f40cedb90491b29745852f8b5c0c06.exe
"C:\Users\Admin\AppData\Local\Temp\d938ef18d15911583674e39a09aa5f58e5f40cedb90491b29745852f8b5c0c06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4072