47854afb3cfeb64a85dda148e00e5ca83168f431a28e5c5fb28733e37f484b13

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:02

Target
PhysicianBed.exe
Size 2.1MB
Sample260802-rcc8dsba87
SHA256 47854afb3cfeb64a85dda148e00e5ca83168f431a28e5c5fb28733e37f484b13
MD5 4f8d31ea9c92ca7d2da3c6438f1c8ea1
SHA1 23039d7c9ae5ce061abef48d04444983d3da15d1
SHA512 ce3e554d39bcac6043b10be569bf8dd4771b66ea506ce2db2f76d48ed88d60906b0cc0e135e2a0cda7b0424db361254198066dfca253583ce029b7acc9128a1b
SSDEEP 49152:BmTaEKDOfJ+XPE+b/Ap8miduNrCIZJ1q51SAP:B8PKR8+Lmid4rn1qC
TLSH
T181A5231223E94482D4BA173A89F554576A31FC628B7236CF72D6FDAE1A13EE4F430316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
2856	AutoIt3.exe
4612	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2856 set thread context of 4612	2856	AutoIt3.exe	89

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 2856	6064	PhysicianBed.exe	88
PID 2856 wrote to memory of 4612	2856	AutoIt3.exe	89
PID 2856 wrote to memory of 4612	2856	AutoIt3.exe	89
PID 2856 wrote to memory of 4612	2856	AutoIt3.exe	89

C:\Users\Admin\AppData\Local\Temp\PhysicianBed.exe
"C:\Users\Admin\AppData\Local\Temp\PhysicianBed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Oregon.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:4612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2844

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oregon.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Oregon.a3x
Size 1.4MB
SHA256 d736aec3cb877ab557bbdc76065d57e6677e69f12b371bd5f09d537baa6be1ed
MD5 b6018d66101e861b618f3b583f2b755f
SHA1 10850fa997758628accc575de1a20ab6e886c08c
SHA512 fe901ee11ebad28d58e54034539045af95822fd50cab9101be9281b6d7b694fb9e5f1849deadeecfb2490704c165e11a251ee9ab648eba771822d1dbcd7a7cce
SSDEEP 24576:VKSlUactLLrn4IajcH9GpX8OJ7NAM65MWcv/OYhduAry/dgKPDrjzPAI+tNR6/:VxMEfwdGpswqz5MWgxXuAjafOtNRk
TLSH
T12E653320256F6381C4B2680F45A56D322B617B71817132EBE4A7FDB6215FDACFC805AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2856-7-0x00007FFD0CF40000-0x00007FFD0D1A3000-memory.dmp

Download

memory/2856-8-0x00000235027C0000-0x00000235027C1000-memory.dmp

Download

memory/4612-10-0x00000243BDE90000-0x00000243BDF67000-memory.dmp

Download

memory/4612-11-0x00000243BDE90000-0x00000243BDF67000-memory.dmp

Download