Analysis
- user interaction
yes - max time kernel
1s - max time network
5s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/07/2026, 22:22
Behavioral task
behavioral1
Sample
test.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
test.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target test.exe
- Size 9.0MB
- Sample260726-2aadtsstgs
- SHA256 396d34c8277418eeddd86fa3cebb3974f9d401bd3de1ad4e67a6397e2648901c
- MD5 b79123302cbaa54438eb85cbdc99d294
- SHA1 647da574af75c19fb02797240572846dd2884884
- SHA512 7a4f319653f7f2ab334e7a2e3ee9395ceeb0ea7353753488fe290f1e8b21e5ff56baa79cd26ee014d23194c2d01b7a582fb7f39f42281c265f5bd248ccc0a5db
- SSDEEP 196608:uZmBrsW4gXyvntTFqq8N3tzCMPWhpHsGXqYBpXFSHK7E:uZmBrktZq5XzzCpHsGXqS7SN
- TLSH T18E96334893D018A7E893727D96B3D156D2E1F8121B32CCEF1792532D2FB37914839AAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Kills process with taskkill 1 IoCs
pid Process 4368 taskkill.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3348 wrote to memory of 2060 3348 test.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"2⤵PID:2060
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM svchost.exe3⤵
- Kills process with taskkill
PID:4368
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\_bz2.pyd
- Size 86KB
- SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
- MD5 28cea50945ec6972c8ec096bf562fb9e
- SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
- SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
- SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
- TLSH T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\_hashlib.pyd
- Size 67KB
- SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
- MD5 ff7c390260b2c94396abcc5323db052e
- SHA1 adc7babe127c3586c81f321ad20ff87785945795
- SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
- SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
- TLSH T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\_lzma.pyd
- Size 157KB
- SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
- MD5 1f2c927c6f1773093e6939e0f0075997
- SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
- SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
- SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
- TLSH T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\_socket.pyd
- Size 85KB
- SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
- MD5 893ee6bcfa6b5a527b61eceb80257871
- SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
- SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
- SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
- TLSH T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\_zstd.pyd
- Size 491KB
- SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
- MD5 256a79eff7505cc58fbf59d863c5c543
- SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
- SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
- SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
- TLSH T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\base_library.zip
- Size 1.3MB
- SHA256 ceb278ffc80ea2124d2f95d3cf221ea52c09880ad1259b069cb9cf187fca494a
- MD5 980bb13ef2516b89f2d823f6bc8c0372
- SHA1 ee358623390f566c031d5447ce43d448e036dbe6
- SHA512 93014db08624629fd564f7c92a7b5376edeb7c431052d0b809088665bac0ea40ca9fc5197c364c467bec873dfb5a4a17b7efa8ebb6adc01131cb9a872d0b9f82
- SSDEEP 24576:RLluUF3dy3iQeOdP2m2dfadRpKMtelbuoL:ruUF3dy3i/WRFs
- TLSH T123552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\libcrypto-3.dll
- Size 1.3MB
- SHA256 342abbeead226baab8bccb4b8bf3a2e5990563f135247bef68755152b3398736
- MD5 f74f1c73d715496bf1f08132ce5a70ed
- SHA1 9180d764a45e558fde0a56d134bc27d146cbdf39
- SHA512 9804419ad6bbc098bc3120f00f4e51938784ed3a42d8b0c41cc9db06d5d024bdfd3faa3a0902f8c7e3bab40c3bfd06ce756bcf89843a5a7ed0cc4f6ecb9b3c32
- SSDEEP 24576:tvTKuk2zPgVIH06iywVOjPWAOjWkE0882bvFdQR+1GbV:5TKuk2z4IU6ilVOjPWdaQw1GbV
- TLSH T1DC55AE2D92E800D8E1BAC67CE55A9613D6B1F06B57F06ADF14B18AB50F27EC0663DF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\libcrypto-3.dll
- Size 1.2MB
- SHA256 ac083bc0c3c162f77a610967badb7fc24785ac6024d08ba2ebd1cca964769f26
- MD5 eb6150123083f29b92acffaf7cc0d207
- SHA1 a9dbcaa90467094b748ba6d1401ed1e0c092fef2
- SHA512 27a85e3db7626e4815b0b51742fc770a15a588d3e9fd05dd410d48744ae668eb7529fa9cf28d6c788556a86eb42a019dcd5be2513be68aa31ee19fb6ad500ab4
- SSDEEP 24576:tvTKuk2zPgVIH06iywVOjPWAOjWkE0882bvFdQR+X:5TKuk2z4IU6ilVOjPWdaQwX
- TLSH T17745AE6DE2E800D8E1BBC27CE65A5613D6B1F06E57F06ADB10A18AB50F63ED0563DF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\python314.dll
- Size 6.5MB
- SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
- MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
- SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
- SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
- SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
- TLSH T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33482\ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH