0b95fa94506a3f84ea4c87a705b44836621466e6a2f208d530d43a1e7014b4c6

Resubmissions

27/07/2026, 15:24

27/07/2026, 15:22

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 15:22

Target
poc.exe
Size 130KB
Sample260727-ssbj6sward
SHA256 0b95fa94506a3f84ea4c87a705b44836621466e6a2f208d530d43a1e7014b4c6
MD5 72588539e7895c88eee3122fe7d56e17
SHA1 a995fc956a68d57a4df473b1d2bd652a17d0a510
SHA512 dbf4762836b3721bc4cf3c3a64a8bc6e4be4ebbe3a8afc3da1740924e3e22fa3f471027d0b9aff8e046407103f9009080416876570db59a0c138729db94f1f2e
SSDEEP 1536:SyZhzkrWQwW7gB7LIxYxaSovpcqAp6yJjiqHtAyGpNxcEZxNLHf8jBEVKTc5Pgy7:SyZh4rrK7OrvFPf8ZT2US
TLSH
T155D319D1BAC5EDDBDB06123884A743292339F7C947C24B131C39B2351E53AD06E9B69B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1184	916	poc.exe	89

C:\Users\Admin\AppData\Local\Temp\poc.exe
"C:\Users\Admin\AppData\Local\Temp\poc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe exploit.xml
  2⤵
  PID:1184

exploit.xml

Path C:\Users\Admin\AppData\Local\Temp\exploit.xml
Size 390B
SHA256 142d48d7d15cdd8322df93dad81de56759f8d12493bee469c9bcadc01bb93e85
MD5 f524fe39e9bdc1635f14a1f20f698be6
SHA1 d94c91e2d4429525607d89b6c81621968729aba2
SHA512 d7b778a0d0a3f39b85a25642fa4bf169e03e115d5127af59fcabd0e1e6d868c0b158dcfa334933edeb3aca84b82ef6ddc839524fa325e5b8148529d610610f70
TLSH
T11EE0C278BCF0CAEC01999574CA29E3C26F60006B927AE0F070ACA550A705DC3CBE31E0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/916-2-0x00007FF6F2990000-0x00007FF6F29B5000-memory.dmp

Download