4c3c9d811c2cba314e1017490f46cdbb20f540d0a9e4b390a0f14d291c84f14a

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:04

Target
2026-08-01_7d1fd6d9ac1e920d294d81296d531f56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 10.4MB
Sample260801-dkty8acf94
SHA256 4c3c9d811c2cba314e1017490f46cdbb20f540d0a9e4b390a0f14d291c84f14a
MD5 7d1fd6d9ac1e920d294d81296d531f56
SHA1 2602e77ce0040c9f8df1157637dc712b013027b9
SHA512 804102b5ce48d45e67e62c4a6d3773be7ff32c0356dbacf12e2f2a808da5f9a7025370573c76792af2d154f4db8e8b9ac9fbededfd9413c3ce473e5797d16667
SSDEEP 98304:WeMhTCIwXb7CNQYbEOs7RTOAPSnbYCEdJroWtEH0:WeRIYb7CNQYbE/sb++
TLSH
T1B9B63A43E8A109B5C1FDE13085668263BB71BC495B2523D72B60FB682F77FD0AA79350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 4680	1312	2026-08-01_7d1fd6d9ac1e920d294d81296d531f56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 1312 wrote to memory of 2676	1312	2026-08-01_7d1fd6d9ac1e920d294d81296d531f56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 1312 wrote to memory of 836	1312	2026-08-01_7d1fd6d9ac1e920d294d81296d531f56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 1312 wrote to memory of 2508	1312	2026-08-01_7d1fd6d9ac1e920d294d81296d531f56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 1312 wrote to memory of 3796	1312	2026-08-01_7d1fd6d9ac1e920d294d81296d531f56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 1312 wrote to memory of 5716	1312	2026-08-01_7d1fd6d9ac1e920d294d81296d531f56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-01_7d1fd6d9ac1e920d294d81296d531f56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_7d1fd6d9ac1e920d294d81296d531f56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentMinorVersionNumber
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentMajorVersionNumber
  2⤵
  PID:2676
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
  2⤵
  PID:836
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CSDVersion
  2⤵
  PID:2508
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseID
  2⤵
  PID:3796
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
  2⤵
  PID:5716