4222f27ede45762d03c7d97f8aed74a221071275a44279f9f94f392d73cddf72

Analysis

user interaction
yes
max time kernel
32s
max time network
34s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 18:12

Target
feather.exe
Size 5.2MB
Sample260727-ws7t6abl2s
SHA256 4222f27ede45762d03c7d97f8aed74a221071275a44279f9f94f392d73cddf72
MD5 65f59477df2404f22717908cd0cf7b39
SHA1 d8b0cc171b3280ff1e86a38df07a40a190802f3e
SHA512 31f4dae98a84cb7052884eb9e35423bdb6bea2c4940ec78eb79af994d20b0b814ce5e4017d708f469b45e7a97df0d056a69dff6b0746d6653ab09ddb4aeeca78
SSDEEP 98304:VW4D4Q2zzeLq4Akp64VWgN6ChuNEW88KnNUz1Gp6eGfCLpPGkLB8:Vnr2zt4XrWbKNJpvL9
TLSH
T1A2468926A6346ACCAA5AB5FCFF0314B3D712F38106CB936593F1F04AB8C3B5D9998511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1544	Feather_Runtime.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 1544	3732	feather.exe	89

C:\Users\Admin\AppData\Local\Temp\feather.exe
"C:\Users\Admin\AppData\Local\Temp\feather.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Users\Admin\AppData\Local\Temp\Feather_Runtime.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather_Runtime.exe"
  2⤵
  - Executes dropped EXE
  PID:1544

Feather_Runtime.exe

Path C:\Users\Admin\AppData\Local\Temp\Feather_Runtime.exe
Size 5.0MB
SHA256 91f9c4ea09381acf78920504f01ee9d6d1832de9bd9d799414bf64ab4e8cb01a
MD5 ebf243a868fdc3b89ead32402130916a
SHA1 97f9be5b1d77de6617c5699e86b25bfce1b91c01
SHA512 385a7ae9e6b7818d1affba8b024c3a526cc5c40732c4344e66814e7685b76ffc1628e68a4db2cd0c4271d59befdd53a59f486fc563cbb5b4ff07f10b1753dbd6
SSDEEP 98304:XcP+wPqmcJZo/Y7mgTm05AwJHE6hmXOlZqL9PlF:TwiZJmg7PAmkx+ZqL1lF
TLSH
T11536BE42B3A1C5E9C166C138CA46D7A7D7323C090F2156EB329C7A1A7F736E04E7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download