e27c89f0b3281427c0fbf528deb07dcca81ef74a4c83e58b0afe1a38a4a4da97

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 18:11

Target
uvw.exe
Size 325KB
Sample260805-wsn22sshjf
SHA256 e27c89f0b3281427c0fbf528deb07dcca81ef74a4c83e58b0afe1a38a4a4da97
MD5 093e36636bb4cd15ec617e1e8b0c9c3c
SHA1 a1622454a00d45ccc6f2950ff487a724b0a14292
SHA512 daee4ed2491cfe642468a10ffffff534fb2298bb57ac1bd7dc4e9f4244e6f37841abf2d4a18ff8467764be470121456fda5bdec97ece2757ef5a6c76684a1b34
SSDEEP 6144:LopgEmtErQDA4jz5iuxpM2yYk0cFNtiMY6wqcUbjM7AP:s03Djz5iWDk0TnUbZ
TLSH
T170644C21BBA658FCE556C078C2468A735A337C860B61B9FF129441353F2BAE16F3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 1420	3280	uvw.exe	85

C:\Users\Admin\AppData\Local\Temp\uvw.exe
"C:\Users\Admin\AppData\Local\Temp\uvw.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\uv.exe
  "C:\Users\Admin\AppData\Local\Temp\uv.exe"
  2⤵
  PID:1420