45c3f335d94cfc451585614a71997da8b1828ccd9808b246ec0ac76613065bf3

Analysis

user interaction
yes
max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:51

Target
OnixLauncher.exe
Size 1.8MB
Sample260730-tattga1fmd
SHA256 45c3f335d94cfc451585614a71997da8b1828ccd9808b246ec0ac76613065bf3
MD5 e4b644822c3d2555193838e35c9a36ca
SHA1 f56cac330418118374be32cca70a0231034391d7
SHA512 3f0fcbfeffb7b720463d06f644ea7969372052760d1c963fb31cfb7ec7f4c4c93d24dbbdb29c1e64fdda72f75152a489d93124d3c7c26b6dcc7e64c476a37468
SSDEEP 24576:gIdJTuDz4u1AS9T7aiIUZznsLer9j4Xi6/G15jucx/z+tRPUEvHXcRqqD:gLDsu1AMz9sEy4jucxb4RMEvhq
TLSH
T164959C1762A441A5C0AAC078CD82860BE6F1B44D4F2296DB86A44E751FE37E15E3FFF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	2600	OnixLauncher.exe

Loads dropped DLL 1 IoCs

pid	Process
5176	OnixLauncher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2600	OnixLauncher.exe
2600	OnixLauncher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2600	OnixLauncher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2600	OnixLauncher.exe
2600	OnixLauncher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 5176	2600	OnixLauncher.exe	89

C:\Users\Admin\AppData\Local\Temp\OnixLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\OnixLauncher.exe"
1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\OnixLauncher.exe
  --info "C:\Users\Admin\AppData\Local\Temp\01F80875484C8BEC1CEE013BC0C675D762DF2C51.tmp.dll"
  2⤵
  - Loads dropped DLL
  PID:5176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5196

01F80875484C8BEC1CEE013BC0C675D762DF2C51.tmp.dll

Path C:\Users\Admin\AppData\Local\Temp\01F80875484C8BEC1CEE013BC0C675D762DF2C51.tmp.dll
Size 1.9MB
SHA256 fb6f491176d29087fa2dd06a9251a5353b80975e763ebfd5649f36c92f4f2ec7
MD5 33fc298c0e93bfd241ce294c60b32340
SHA1 65cae621ed0303c800c10546f8cb32e92294b4e2
SHA512 45a8989f6d9b997de107c26d6b3375ed128659c340a455a19cbefd94680cf51db71cdec4aa0ba845a5b56cf70b7508381a1b0413daa7e2f5c86c877722e802bc
SSDEEP 24576:A2ROaQ43D/v7VsW3H3dZ1xnHgNywxGcTUMW9vjv8PoYTze/thFH3:dRZQ4T/v7uW3H3bHgpUn26/zF
TLSH
T1B4954B2261D8E0D8E066E07885825E03DF21744E135895EF02FC9B5D8EF36D79E7EA8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download