Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 14:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HWIDR_External.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
HWIDR_External.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target HWIDR_External.exe
- Size 10.3MB
- Sample260720-ryvdssft61
- SHA256 4091a5846d3ad9adda334343a2f6d6b26337852eead56fb5850f18467241c6b2
- MD5 eeba1902f9c6fa0d7ca52ee23a839be4
- SHA1 1f4ed2ca915404b85caa2739670e918e974f1789
- SHA512 9f7b12f194182c553898f22f46b91ba0a1b18ab67db8d8096a1c0bc82da53b926cd8a8ab3e3d110b6a97e5de4e13a73b792857870362cff3039ee19d2346da82
- SSDEEP 49152:0K7PnNvpNAErDe9DbY8WRxBJNNqaiq+fpwn5iB27tgKPU/S7CQnfGTXbFNL3DUM0:Tt3AbyHz+fZgh
- TLSH T129B6EA4E68520ECBE6C3DA392C6D3E135C2B3B7B551C433BADEC2492536A78419CB647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 1056 HWIDR_External.exe 4748 HWIDR_External.exe 1056 HWIDR_External.exe 4748 HWIDR_External.exe 1056 HWIDR_External.exe 1056 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe 4748 HWIDR_External.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1056 wrote to memory of 4748 1056 HWIDR_External.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\HWIDR_External.exe"C:\Users\Admin\AppData\Local\Temp\HWIDR_External.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\HWIDR_External.exe"C:\Users\Admin\AppData\Local\Temp\HWIDR_External.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748
-