6569e21744a4f1d363c1a393ad75471072c8a17740b08c202b66af0a92cf961a

Analysis

max time kernel
300s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 13:24

Target
Setup.exe
Size 22.0MB
Sample260802-qnvq5stdre
SHA256 6569e21744a4f1d363c1a393ad75471072c8a17740b08c202b66af0a92cf961a
MD5 3f7e9b7820cac7f9ac66585305963e37
SHA1 dd7b5e35a5cb5aeb89d1e91ae7e6b2bfa1d3b01c
SHA512 bd2b89869338931b417bc16dbf805420fc6147952378073d64f44ebdf81ff65cfc8127c0a5fd57b873eb28bc93b71fbabc267d71b7c7a00c9f5de65ff492c52d
SSDEEP 49152:NdTeiaHKGz7VOfbNfwejyvkMz7X4zeE+xoSITAd0AM3ejTDt:ToKYVOfhfZiJzE+gAuAM3ejV
TLSH
T10F37332253D20661F87A1B7964F910339134BCD6CFAA82EF73E49ACB1E73A569435307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2608	AutoIt3.exe

Executes dropped EXE 2 IoCs

pid	Process
2608	AutoIt3.exe
6036	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2608 set thread context of 6036	2608	AutoIt3.exe	90

Suspicious behavior: EnumeratesProcesses 18 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 2608	3100	Setup.exe	89
PID 2608 wrote to memory of 6036	2608	AutoIt3.exe	90
PID 2608 wrote to memory of 6036	2608	AutoIt3.exe	90
PID 2608 wrote to memory of 6036	2608	AutoIt3.exe	90

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Spelling.a3x
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:6036

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spelling.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Spelling.a3x
Size 1.5MB
SHA256 b572daf0af38b0d4715b9f275d3909b9c67ba23b5b46102ab57c1a031b0666ab
MD5 9d1af84a6e1360a83c21b488b892f8af
SHA1 e031d9c1e238c818721bbf8639b2ca57da593ea8
SHA512 e1efe3b78e5fbd2106f090ee81316f9d5c61414927e0420f47f76b6d5eace6f7e120b6eb5014a1b99d24ffd02d9e84cdcbf366e24cb76dd8af83ea39c8d08ecb
SSDEEP 49152:4AjaAZBzmV/8VpSwVaxtkUTSv4b8E+SrSITCD:4mZMV/8jSTLTTL+oCD
TLSH
T12975333575534F35AF652AEBB01C3026920D16E9CFCB4569F9B99FD708F1B3AA0A80C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2608-7-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp

Download

memory/2608-8-0x00000192EE6A0000-0x00000192EE6A1000-memory.dmp

Download

memory/6036-10-0x0000016A4A9F0000-0x0000016A4AC2A000-memory.dmp

Download

memory/6036-11-0x0000016A4A9F0000-0x0000016A4AC2A000-memory.dmp

Download