85181246483047792c1fea02474eac891278ba2666184541160fa37db68d1188

Analysis

user interaction
yes
max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 01:55

Target
potato.exe
Size 1.4MB
Sample260728-ccec5ahn3v
SHA256 85181246483047792c1fea02474eac891278ba2666184541160fa37db68d1188
MD5 98349dea9a4703b75fb314f05cde6f0c
SHA1 bd480c7398246eb634390d04ea8a3a72bbac55a4
SHA512 277f974810663fcf1ac6d63a16ac86d05e90c96eb41cee45e9166feff968ed850d90fed27aace3fc648045612486994aeb8b1d52257360d72e6f8ec7be7cca45
SSDEEP 24576:p+YmY1nfl5d9Id2iqywIiyn769aagTl4PmUIgi7yEB5ZjG9XkMUz:MYxrd9Id2iJwVynoaplG5fEB5ZKujz
TLSH
T14265BE03F3A283ACD41669394793D726B3377C442B12D1CBB3A426588BA76F41EB76C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\potato.exe
"C:\Users\Admin\AppData\Local\Temp\potato.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2976