47ab3dd12670be5c66a6aed68419c0961b6d7f643d322800fbf2f57bf8285e2f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 07:28

Target
2026-07-20_db24942e747abb418bb49e94ca6d619b_.exe
Size 1.8MB
Sample260720-janmcacx5s
SHA256 47ab3dd12670be5c66a6aed68419c0961b6d7f643d322800fbf2f57bf8285e2f
MD5 db24942e747abb418bb49e94ca6d619b
SHA1 6f2fc2a0ceb2ddc2d6632261c39846ef220aec95
SHA512 24e78a8471b3b56eeb9d53b22760da0a8929a1c7f9d609f8c2786092b86883e66e90337537adde4d912348b305276d9cd95b45ddc882dfe3282579109e7a98e4
SSDEEP 24576:qGljzsJQW1H84KBem8Z1OVfiNyI8JsU3Aot+Ec0xMkWd0MzWsRXF:TljzsJQ684KBo1o9Kd0MzWsRXF
TLSH
T18095FA83BACB4DE6CEC667B496D343316378FD518B1A5F2F6A08C2316D536C5AD4AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 704	4436	2026-07-20_db24942e747abb418bb49e94ca6d619b_.exe	90
PID 704 wrote to memory of 2844	704	calc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-20_db24942e747abb418bb49e94ca6d619b_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_db24942e747abb418bb49e94ca6d619b_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:2844

memory/4436-0-0x0000000000400000-0x00000000004FF000-memory.dmp

Download