5de27e922b1ff2ca06e0454129506afa847864214e2a0e73b9453fffbf93f752

Analysis

max time kernel
149s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 19:52

Target
1.2.8.2505.06/All Stars.exe
Size 638KB
Sample260724-yllpfsdh59
SHA256 5de27e922b1ff2ca06e0454129506afa847864214e2a0e73b9453fffbf93f752
MD5 e67891a822aabccd3a64b08406e9e52c
SHA1 d2b05cfbbf820faa1309bad5941ece0c7a971f24
SHA512 01c840cf02c1c6539bacd4292a7d2361e8fe79455d4801d27dd19925314e4a14861e9fe02c809ffdcaf65e2f3db3a433e04674d26776bb7fca6b6a9c095bcaf1
SSDEEP 6144:bEbaWnBUCGhEI+ZaXYToH5O4WKjzE8wdTLYj10u8IFRiL73m:boCCijYToHg/qE8qTLSuuKu
TLSH
T15ED4BB51081E61D3E1F891345219D8FEB9325F905AEE1D446EABFEE3B5B39CB9028C13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{07A83530-8E35-41B5-91D3-919905B60215}	All Stars.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2092	All Stars.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 5000	2092	All Stars.exe	87

C:\Users\Admin\AppData\Local\Temp\1.2.8.2505.06\All Stars.exe
"C:\Users\Admin\AppData\Local\Temp\1.2.8.2505.06\All Stars.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\1.2.8.2505.06\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\1.2.8.2505.06\UnityCrashHandler64.exe" --attach 2092 1578371387392
  2⤵
  PID:5000

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x304
1⤵
PID:3496

memory/2092-9-0x00000171708A0000-0x0000017170FC9000-memory.dmp

Download