38be45d6385b38b65bb2d1972f618511a33cd4068cb1b8a7be7aed0ecedb4471

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:52

Target
38be45d6385b38b65bb2d1972f618511a33cd4068cb1b8a7be7aed0ecedb4471.exe
Size 59KB
Sample260720-dctngsc17q
SHA256 38be45d6385b38b65bb2d1972f618511a33cd4068cb1b8a7be7aed0ecedb4471
MD5 6e4292dea1ce2dff8c1ab2b476dd5801
SHA1 104c62c3454a7f7b2679ed9d37fd20fb86203362
SHA512 8845fa5b0e0ca7f8d5a5f861fc37a0d0f84614eaa6d9137ee26b9708e95a34ef7a8ff271a4239bffddfa03b955f20775153608e9f7c3665fe5e83c319c97aa4d
SSDEEP 768:D9TITHYMcQUuH5yD1i4Jj9cCAUb1LuKruPszjV2cV:D9EiQUcEDfpqCAUbDaszjjV
TLSH
T17A5350E57ED55CC7ED64637C62EAC231273CFAD08A434707A52066321E13ED03EE928A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3148	3536	38be45d6385b38b65bb2d1972f618511a33cd4068cb1b8a7be7aed0ecedb4471.exe	88
PID 3148 wrote to memory of 2664	3148	calc.exe	90

C:\Users\Admin\AppData\Local\Temp\38be45d6385b38b65bb2d1972f618511a33cd4068cb1b8a7be7aed0ecedb4471.exe
"C:\Users\Admin\AppData\Local\Temp\38be45d6385b38b65bb2d1972f618511a33cd4068cb1b8a7be7aed0ecedb4471.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:2664