d943627c68e6017a4cd59df1c18c4345835cff6662aaf63b627fc9f74b662db3

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:27

Target
$1/MFP/mfputil_x64.exe
Size 208KB
Sample260802-pm286asgre
SHA256 d943627c68e6017a4cd59df1c18c4345835cff6662aaf63b627fc9f74b662db3
MD5 f7b33860093a3ab4cdf90a7e33ab0e1b
SHA1 10e3b93e7a795d2f73f7bd9b29cfc5a915077077
SHA512 8e282016832f79ffc7f1f38d9ffe499e9adfc380a27e15c2a3d3241c328fa6e8730db1270a2e13024d9e431bd862f47845c76562eb9e543e325f1486268b376a
SSDEEP 3072:iu7OreFwLjLgt0kv03mPpukbQtTLx6ra8+TUc0RIOlZ1+cmNztQbXwU:97c8wLjLtV6puoQtsrR+TUcmetCAU
TLSH
T1F8244A4AF7A480F5C47BC139C992566AF6B1B85A877093CB5364873A5F233E0AD3D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3364	sediag.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3364	1924	mfputil_x64.exe	85

C:\Users\Admin\AppData\Local\Temp\$1\MFP\mfputil_x64.exe
"C:\Users\Admin\AppData\Local\Temp\$1\MFP\mfputil_x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\$1\MFP\x64\sediag.exe
  "C:\Users\Admin\AppData\Local\Temp\$1\MFP\x64\sediag.exe" -removelsp 871373693
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3364