32b3ce96dbc62f543623a98ebebcc1eb0bd87c233fbd60b578d9bf70c0116790

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 16:44

Target
32b3ce96dbc62f543623a98ebebcc1eb0bd87c233fbd60b578d9bf70c0116790.exe
Size 4.2MB
Sample260730-t8596asdkh
SHA256 32b3ce96dbc62f543623a98ebebcc1eb0bd87c233fbd60b578d9bf70c0116790
MD5 c592a8c20d77a682bbbebaa2e1406bfc
SHA1 728bc24a771879fc3c9729e0bf5448560387edbf
SHA512 da1fa58d03422ed883bb346b7e01d919f3fcfb88709ea3f19a35dcacd8ae9d3d6272b98892d4468307ec06d4b2331931d4a4b85fc303e473eacfb9ad97c9dc88
SSDEEP 98304:QFAn/n12/Q35M10ocf5yeMvvNTXCw2kxIB5fwRz4+dCOIqcabXSnn2F:QutG3JseIB544+dCOBLXSnn
TLSH
T16E16BE42B28649A0C9D65B798C9352758732BD18AF3A8F77350CE9313F336E16D3BA41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3992	TARGET.exe

Loads dropped DLL 1 IoCs

pid	Process
3992	TARGET.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3992	4768	32b3ce96dbc62f543623a98ebebcc1eb0bd87c233fbd60b578d9bf70c0116790.exe	85

C:\Users\Admin\AppData\Local\Temp\32b3ce96dbc62f543623a98ebebcc1eb0bd87c233fbd60b578d9bf70c0116790.exe
"C:\Users\Admin\AppData\Local\Temp\32b3ce96dbc62f543623a98ebebcc1eb0bd87c233fbd60b578d9bf70c0116790.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\TARGET_bundle_4768\TARGET.exe
  "C:\Users\Admin\AppData\Local\Temp\TARGET_bundle_4768\TARGET.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3992

Offsets.local.ofs

Path C:\Users\Admin\AppData\Local\Temp\TARGET_bundle_4768\Offsets.local.ofs
Size 1KB
SHA256 d2d3697af47992b2636f8eec52add9f3b2c094cc5c3391c1ac642727a5ff36a3
MD5 7c5d268620af9ac3b34d355b4d5a183c
SHA1 6a0e17c87b241c49f3a78bc97891146e57592a25
SHA512 a5744878526c09a1b65a05d1f3f3c1351795119aa5386dfeeac3ff5e119eb23df4d8f6867e7a6a8091a97af54e9f841954f04e05c74c7587febd0db497053d10
TLSH
T1E1117B58035B2F07849D6849F44448249E97AB4296A7C1B6F3CDE81B61CBD3D4135B7B
MD5 SHA1 SHA512 TLSH

Submit Download

TARGET.exe

Path C:\Users\Admin\AppData\Local\Temp\TARGET_bundle_4768\TARGET.exe
Size 3.5MB
SHA256 2f86c69d34e69d6facb5d28c561d1f9175e1827fce6f55c9d8ad0109180104ee
MD5 320e0a5d2959a3aef5ef9312874feaa2
SHA1 03a1012fe036ae4704e4fcefee990f5b3b1e74b0
SHA512 40686d8e68754d1bba2208c08ff218b82427ec99d7b235e73be12fc4cf1717c838c291d5ac1cc9db713181fe3049046806eeaa70d8ad85cac94ecacf85dcc43c
SSDEEP 98304:BM10ocf5yeMvvNTXCw2kxIB5fwRz4+dCOIqcabXSnn:BtG3JseIB544+dCOBLXSnn
TLSH
T1F906DF51F34281A0C59A8936CC0289A186327C1DBF2A9F77355CFD623F736E16E7BA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

target_local_auth_hook.dll

Path C:\Users\Admin\AppData\Local\Temp\TARGET_bundle_4768\target_local_auth_hook.dll
Size 46KB
SHA256 97443b8b4749e2bb6b4295e1bdde490a8fd0db20e7df2347b7e93f845dfadfef
MD5 913caec5030155afacfdea834a5b4266
SHA1 63374733aa424e621a12c73565630005bdb38390
SHA512 35106cf9eb5726fdc1d3c5646184ecf0e657287e4fa803ca9f26944bde8da3c76cf10b1a88a56770139ab389048a6f03f751ac6ea8aae16d39c375307c7a2dcd
SSDEEP 384:E0aHHBMXkjJpuuggtdZRasVyvDsqO48AT/3prSAEdQRBM5bZd4MMAMJSjF2L+yeZ:bkHFPlatvY48ATxrSpd4BEbZbY8F21eZ
TLSH
T1C22362D43ED45CC7EE35A27C16E6D2323A3CB5D086934B07A630A5321E13BD17EE9686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3992-9-0x0000023FDF430000-0x0000023FDF431000-memory.dmp

Download

memory/3992-8-0x0000023FDF430000-0x0000023FDF431000-memory.dmp

Download

memory/3992-12-0x00007FFBDA4C0000-0x00007FFBDA4D4000-memory.dmp

Download

memory/4768-11-0x00007FF699950000-0x00007FF69999E000-memory.dmp

Download

memory/4768-19-0x00007FF699950000-0x00007FF69999E000-memory.dmp

Download