d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 07:57

Target
2026-07-20_07f2c7b0eeaa8233a52c7a44b034bb4f_.exe
Size 1.8MB
Sample260720-js983adw2w
SHA256 d4aad8326e4d99a66c02db7f3253d892d38d04c2ec8524e764da002bb70c7952
MD5 07f2c7b0eeaa8233a52c7a44b034bb4f
SHA1 047e8e95318424301aa4dac2de28320e7f35eabc
SHA512 f49bfcdefd95291113bcca05840a92b71106eacf211ed8b309da18f5d3fa40e85a21ddac9df11df558b7e25ee56319804a5fecc1c651cd35fae7245a4fbbd562
SSDEEP 24576:LihwrqMYwVyFfHHe+m6Dr2ZnWrxZnG8JsU3Aot+Ec0xMkWd0MzWsLZF:mhyqMY9FfHHewr4WnUd0MzWsLZF
TLSH
T19D95EA83BACB4DE6CAC667B496D343316378FD518B1E5F2F6A08C2316D536C5AD4AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 3284	2496	2026-07-20_07f2c7b0eeaa8233a52c7a44b034bb4f_.exe	89
PID 3284 wrote to memory of 692	3284	calc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-20_07f2c7b0eeaa8233a52c7a44b034bb4f_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_07f2c7b0eeaa8233a52c7a44b034bb4f_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:692

memory/2496-0-0x0000000000400000-0x00000000004FF000-memory.dmp

Download