67b1659359d9cf388d4af1fcdb5a9e473c12410929df7a1267669e287d32f6af

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:13

Target
67b1659359d9cf388d4af1fcdb5a9e473c12410929df7a1267669e287d32f6af.exe
Size 60KB
Sample260804-27f8mssgkf
SHA256 67b1659359d9cf388d4af1fcdb5a9e473c12410929df7a1267669e287d32f6af
MD5 0382a17f4f3ff78ef847aaf5b840dd01
SHA1 f2d27a41c3581d40d56725745064aaa8305671a9
SHA512 840f6463f2fe6c8bfc15ac74c90bb2c262e542494a52e3b4220ddf8819df0b92aa7814099bbbb5353df56efc7b48e6a116273c34403e71e6f8c7ba316c131165
SSDEEP 192:EYYGrURUY0VnQSQHSwQMx1TTAYYGrURUY0VnQSQHSwQMx1TTAYYGrURUY0VnQSQ9:EYSmVQ5MYSmVQ5MYSmVQ5
TLSH
T138534256B7F91016F9FB677D6C3D02084269BB4977B249EF020A20940DB47E06938BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1268	1388	67b1659359d9cf388d4af1fcdb5a9e473c12410929df7a1267669e287d32f6af.exe	85

C:\Users\Admin\AppData\Local\Temp\67b1659359d9cf388d4af1fcdb5a9e473c12410929df7a1267669e287d32f6af.exe
"C:\Users\Admin\AppData\Local\Temp\67b1659359d9cf388d4af1fcdb5a9e473c12410929df7a1267669e287d32f6af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Users\Admin\AppData\Local\Temp\67b1659359d9cf388d4af1fcdb5a9e473c12410929df7a1267669e287d32f6af.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4164