cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 05:14

Target
cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe
Size 5.1MB
Sample260803-fxca2sce63
SHA256 cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a
MD5 ed91abbbb6b91070838b52b308d7a792
SHA1 5cea5241933bc1add3d465adfb7b73aae4cdd016
SHA512 5395811db1991ac070633a32cd94a779412e04e46410c92082e4e682df9ff91ccd478c08cac6534adf5dd4a4ea5bb0cacd7e8fec2b317945bf1c3372fcea8691
SSDEEP 98304:GbBMCHtvdIWXe+q2WWmQanh+oFAZTAxidupkxk/MtYpb3ySot9:GbBt1d9e+q2WWmQqh+ZZREEkEtY9Kt9
TLSH
T14E36336051A428E7FB764738D8D2B716E5FBF1402794C18B07204AE56F63AE83EB9364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Loads dropped DLL 3 IoCs

pid	Process
4644	cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe
4644	cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe
4644	cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	4644	cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 4644	1860	cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe	89

C:\Users\Admin\AppData\Local\Temp\cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe
"C:\Users\Admin\AppData\Local\Temp\cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe
  "C:\Users\Admin\AppData\Local\Temp\cf0384d99bdbf9900465f9cedc0062048880c390e4d82bbfccbd78fd8d51902a.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4644

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18602\VCRUNTIME140.dll
Size 87KB
SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
MD5 0e675d4a7a5b7ccd69013386793f68eb
SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
SSDEEP 1536:EFmmAQ77IPzHql9a2k+2v866Xc/0i+N1WtYil42TZiCvecbtjawN+o/J:EQmI+NnXertP42xvecbtjd+ox
TLSH
T19E938D85B3B80292E056E13CC162DE57E678F981577087DF03759B9E1F83BE19E38A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI18602\base_library.zip
Size 775KB
SHA256 4bc0009925cc5648746b8d8faeb365f90163a32e6d7318d9c30e135a0d524f38
MD5 9365718c1c11d87d0eb661abb5de5afb
SHA1 40e93f5882de0041ed9038b0c463ebc05d9e85ca
SHA512 b235bbb1b521942647366c04f223c61f9b299ee7c2e1b4114372e5d2d474699c83926978845d84eaa3fa5c6bd317f870ff6a615dfa23224e10e3e47c8fa82023
SSDEEP 24576:dIGT+dosQNRs54PK4ICEVi+Zsf6EanuzRN:dIGT+dosQNRs54PK4IBZu
TLSH
T1D2F4F741BAA22ED7FC09F3BC422ECA2C4A2A5335DB49D1077D4FC2583F4A7D02E65959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python37.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18602\python37.dll
Size 3.6MB
SHA256 1cfdd40a9107d89310e4e3b6df5f25f26944b312e61638d014f1b1a8050ccc07
MD5 d558d4db5a6bd29a8b60b8aa46e5329a
SHA1 a5036009de7165b1b4721263eae4b240ee689095
SHA512 5590fbd6c9c81293b21e9da9d35d5177f03ba3d247771e4abef3420420d9024f3a775796d73becd5aeb469df648d3105a016693c6b8f68e8c61399212439eebf
SSDEEP 49152:1TeuSWg7sxvzSxFHYxcim9kOTl8MiYGYwjy9x6xN2BjXISsOIjbXH3EM6nPP8MTj:dcdOMiY+yXCNnjTHUM68wsNyPH
TLSH
T1F9069D32A3600155DEB7947AC913864BDBF1FC446F20E35A41A4BAD52F73BA306EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4644-19-0x0000027043330000-0x00000270436F7000-memory.dmp

Download