45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:14

Target
45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe
Size 764KB
Sample260801-pergpavaqe
SHA256 45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700
MD5 c1adc6a4020a2e3306995b7d60583c00
SHA1 29fd8a9ecf3bfc08bf68759c700639937f195a3d
SHA512 e6b31ceb394bc9da1d3b72ed1de9508116d3b69aa81970888a152f8b0def8b94386948b98f83b1decbf7e8456c58f0bb819ae7618fe0271b7dd44b0c05ccb4a5
SSDEEP 12288:X7xo/m8gFLdvU9DejRMVsz3+rtrO0vzmEl:X7xaDejR6pFzz
TLSH
T179F43905AB5D0096F16E6278C49EE6B3B2B27C105BE09ACB02D07D3B3E3D5D67D39261
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3204 set thread context of 4888	3204	45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4888	3204	45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe	88
PID 3204 wrote to memory of 4888	3204	45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe	88
PID 3204 wrote to memory of 4888	3204	45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe	88
PID 3204 wrote to memory of 4888	3204	45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe	88
PID 3204 wrote to memory of 4888	3204	45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe	88
PID 3204 wrote to memory of 4888	3204	45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe	88
PID 3204 wrote to memory of 4888	3204	45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe	88

C:\Users\Admin\AppData\Local\Temp\45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe
"C:\Users\Admin\AppData\Local\Temp\45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Local\Temp\45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe
  "C:\Users\Admin\AppData\Local\Temp\45896c0fe6dc382e592d4ca46a21025cb59ed2b4a7f6cac2a047650f6667f700.exe"
  2⤵
  PID:4888

memory/3204-0-0x0000000140000000-0x00000001400F0000-memory.dmp

Download

memory/3204-5-0x0000000140000000-0x00000001400F0000-memory.dmp

Download

memory/3204-13-0x0000000140000000-0x00000001400F0000-memory.dmp

Download

memory/4888-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4888-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download