d4d4c10fced307e209744cf98a56b003a6e613424fd651b08469274704afd2c6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 06:20

Target
officecli-win-x64.exe
Size 31.8MB
Sample260731-g376caxtew
SHA256 d4d4c10fced307e209744cf98a56b003a6e613424fd651b08469274704afd2c6
MD5 e5fbd9b50b4146058b6579918aeaf7e0
SHA1 05d0b1fe3cfc55c4a55e60bee8be29aedbe4bd14
SHA512 188b63c8e9fe0cb8eedf735dbf2320f754ebcc44adc9a60c1c616cf02ffbadc28220314e13b27f415fd426118916322f15022b97eb431afd15c531b19fdc3cb7
SSDEEP 393216:kLP+fuJrTBYPJYM6mJZ22v38kH6u+G7AXY:bGYdfmGvH6u+G7AXY
TLSH
T17B778C20E7E84A25E6BE8379A4751116EB71FC0B6751D7CF389C90E92F23BC09924F52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3592	1836	officecli-win-x64.exe	89

C:\Users\Admin\AppData\Local\Temp\officecli-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\officecli-win-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\Temp\officecli-win-x64.exe
  "C:\Users\Admin\AppData\Local\Temp\officecli-win-x64.exe" __update-check__
  2⤵
  PID:3592

config.json

Path C:\Users\Admin\.officecli\config.json
Size 204B
SHA256 15b55c9fd8bc71c5f0def856b6e5a842103e588d72c3522be9177dbf85a362f7
MD5 f91413f3f832e37140b2661cd203164e
SHA1 c0be9f5eaf131e90cd1ad4582eeaab62458491aa
SHA512 78ac704b1867c602ec40647a1d5db1cc6e2b12e3accc3991f4c9b6cc51c079fbf45e0537262ffa1f2879d7cc7824aa844314386818d1f484237a0cc72618b0ee
TLSH
T144D012614545883614310765562A554276909F1F63386D1B36F7B240E353BBC182BB62
MD5 SHA1 SHA512 TLSH

Submit Download