d4d4c10fced307e209744cf98a56b003a6e613424fd651b08469274704afd2c6

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 06:20

Target
officecli-win-x64.exe
Size 31.8MB
Sample260731-g376caxtew
SHA256 d4d4c10fced307e209744cf98a56b003a6e613424fd651b08469274704afd2c6
MD5 e5fbd9b50b4146058b6579918aeaf7e0
SHA1 05d0b1fe3cfc55c4a55e60bee8be29aedbe4bd14
SHA512 188b63c8e9fe0cb8eedf735dbf2320f754ebcc44adc9a60c1c616cf02ffbadc28220314e13b27f415fd426118916322f15022b97eb431afd15c531b19fdc3cb7
SSDEEP 393216:kLP+fuJrTBYPJYM6mJZ22v38kH6u+G7AXY:bGYdfmGvH6u+G7AXY
TLSH
T17B778C20E7E84A25E6BE8379A4751116EB71FC0B6751D7CF389C90E92F23BC09924F52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4100	4288	officecli-win-x64.exe	89

C:\Users\Admin\AppData\Local\Temp\officecli-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\officecli-win-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\officecli-win-x64.exe
  "C:\Users\Admin\AppData\Local\Temp\officecli-win-x64.exe" __update-check__
  2⤵
  PID:4100

config.json

Path C:\Users\Admin\.officecli\config.json
Size 204B
SHA256 90950b342ec06dff596b9cfe68b2fd41202aff53b7091070ac2b19ca4e0e1bc2
MD5 a53f5ad0568ea74949de5911035a9be1
SHA1 4d2669cd1fb76e51622c6bd831dcd78e780d99aa
SHA512 a8c7d7b58e6b22c70a1abd2b5f9ea91f1b094d38aa3d7cf2311c5b407d587410e684db86823ee5ee1fc4caebd4ff4667d6d000c10c9cb291ebb2e8677d323972
TLSH
T10CD0126145498C77147107648639855276A49F4F63386D1F36F76240A342B7C183BB52
MD5 SHA1 SHA512 TLSH

Submit Download