d943627c68e6017a4cd59df1c18c4345835cff6662aaf63b627fc9f74b662db3

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:27

Target
$1/MFP/mfputil_x64.exe
Size 208KB
Sample260802-pm286asgre
SHA256 d943627c68e6017a4cd59df1c18c4345835cff6662aaf63b627fc9f74b662db3
MD5 f7b33860093a3ab4cdf90a7e33ab0e1b
SHA1 10e3b93e7a795d2f73f7bd9b29cfc5a915077077
SHA512 8e282016832f79ffc7f1f38d9ffe499e9adfc380a27e15c2a3d3241c328fa6e8730db1270a2e13024d9e431bd862f47845c76562eb9e543e325f1486268b376a
SSDEEP 3072:iu7OreFwLjLgt0kv03mPpukbQtTLx6ra8+TUc0RIOlZ1+cmNztQbXwU:97c8wLjLtV6puoQtsrR+TUcmetCAU
TLSH
T1F8244A4AF7A480F5C47BC139C992566AF6B1B85A877093CB5364873A5F233E0AD3D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1040	sediag.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 1040	108	mfputil_x64.exe	90

C:\Users\Admin\AppData\Local\Temp\$1\MFP\mfputil_x64.exe
"C:\Users\Admin\AppData\Local\Temp\$1\MFP\mfputil_x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:108
- C:\Users\Admin\AppData\Local\Temp\$1\MFP\x64\sediag.exe
  "C:\Users\Admin\AppData\Local\Temp\$1\MFP\x64\sediag.exe" -removelsp 871373696
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1040