d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 07:57

Target
2026-07-20_07f2c7b0eeaa8233a52c7a44b034bb4f_.exe
Size 1.8MB
Sample260720-js983adw2w
SHA256 d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952
MD5 07f2c7b0eeaa8233a52c7a44b034bb4f
SHA1 047e8e95318424301aa4dac2de28320e7f35eabc
SHA512 f49bfcdefd95291113bcca05840a92b71106eacf211ed8b309da18f5d3fa40e85a21ddac9df11df558b7e25ee56319804a5fecc1c651cd35fae7245a4fbbd562
SSDEEP 24576:LihwrqMYwVyFfHHe+m6Dr2ZnWrxZnG8JsU3Aot+Ec0xMkWd0MzWsLZF:mhyqMY9FfHHewr4WnUd0MzWsLZF
TLSH
T19D95EA83BACB4DE6CAC667B496D343316378FD518B1E5F2F6A08C2316D536C5AD4AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5464	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4268	4732	2026-07-20_07f2c7b0eeaa8233a52c7a44b034bb4f_.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-20_07f2c7b0eeaa8233a52c7a44b034bb4f_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_07f2c7b0eeaa8233a52c7a44b034bb4f_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  PID:4268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5464

memory/4732-0-0x0000000000400000-0x00000000004FF000-memory.dmp

Download