d4ff28d0d074593828d84448d4ca3a44be022b8398f219fbb59e108175493ff5

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 04:33

Target
d4ff28d0d074593828d84448d4ca3a44be022b8398f219fbb59e108175493ff5.exe
Size 37KB
Sample260806-e6shystamb
SHA256 d4ff28d0d074593828d84448d4ca3a44be022b8398f219fbb59e108175493ff5
MD5 c16e729349de7508dfe514d39add8474
SHA1 6c3ddabcd561d80f0912269e04719c70a949e937
SHA512 6dd312dfa6e5a89de025ce0861d7be942e50fe95e7c4ad266e391c030d0d7a08925c92ff114a6b1a34e7a3c108d47c3c53498de7769ba5f8d49df37a69a80ae0
SSDEEP 96:IfzU5I5WXx/8A8uQcTWS6rScgY8bkR31WqTQPwIflkflxcDJKYMbM/7juJEZtWdJ:If45IWhQHSwQMx1TTh1/UAZzMo
TLSH
T1C3039AA07FAA4486F671A23C9CFA83347B3DFAE506B647578514B5724D22BC02DE8713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2468	4600	d4ff28d0d074593828d84448d4ca3a44be022b8398f219fbb59e108175493ff5.exe	87

C:\Users\Admin\AppData\Local\Temp\d4ff28d0d074593828d84448d4ca3a44be022b8398f219fbb59e108175493ff5.exe
"C:\Users\Admin\AppData\Local\Temp\d4ff28d0d074593828d84448d4ca3a44be022b8398f219fbb59e108175493ff5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Users\Admin\AppData\Local\Temp\d4ff28d0d074593828d84448d4ca3a44be022b8398f219fbb59e108175493ff5.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4468

memory/4600-0-0x0000000000400000-0x0000000000407000-memory.dmp

Download