ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:14

Target
ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe
Size 206KB
Sample260804-ncevfavsb1
SHA256 ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb
MD5 e3848b36b81da1b80a784192e699ad55
SHA1 e3365a9455795d3d768e72289a174d8a3ca9f22b
SHA512 21123438872131a2454d1e21d2940070f314b9ddc740987fbc78b53449bb7783f7f59f63cb8751206d5d0321041fe5a1a095ccdb4db9861cf2da509d2e854e96
SSDEEP 3072:F6ZNflhbYJ7D24fOvoJSLSVb+JL/fFeQ8BuA6N3U827PcIj8sAA/V:F6ZNflhbYVpJFVb+B/tIBuA6qb7U+2A
TLSH
T16A249E0AF7A8C6ECD0BA417895821513E335340A172097CF37A1936DEF76AE4DE7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 5904	1152	ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe	89

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 5904	1152	ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe	89
PID 1152 wrote to memory of 5904	1152	ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe	89
PID 1152 wrote to memory of 5904	1152	ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe	89
PID 1152 wrote to memory of 5904	1152	ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe	89
PID 1152 wrote to memory of 5904	1152	ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe	89
PID 1152 wrote to memory of 5904	1152	ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe	89
PID 1152 wrote to memory of 5904	1152	ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe	89
PID 1152 wrote to memory of 5904	1152	ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe	89

C:\Users\Admin\AppData\Local\Temp\ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe
"C:\Users\Admin\AppData\Local\Temp\ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe
  "C:\Users\Admin\AppData\Local\Temp\ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb.exe"
  2⤵
  PID:5904

memory/1152-0-0x0000000140000000-0x0000000140047000-memory.dmp

Download

memory/1152-3-0x0000000140000000-0x0000000140047000-memory.dmp

Download

memory/5904-2-0x0000000140000000-0x000000014001A000-memory.dmp

Download

memory/5904-1-0x0000000140000000-0x000000014001A000-memory.dmp

Download