d58b14556729ed26c283e58dd217c387e17cded42beb5285a8a66cf8ab13134e

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 12:32

Target
p.exe
Size 11.3MB
Sample260806-pq2f2a1cnd
SHA256 d58b14556729ed26c283e58dd217c387e17cded42beb5285a8a66cf8ab13134e
MD5 85a283a2a0445ad54f8371cc6ce38c86
SHA1 0cdc02c9dabf6744a32aad7c44d7497b693e4959
SHA512 1928c7d21b03755150ff3ebbada19932ca8d4cb11fb43bc4d93f93b18658609e97b7a83243390f56878c72d03240bf7de96e2776e01ae93529568a8b6bc8ef85
SSDEEP 196608:2lZF/bwQ4/7AWF6qXPFgpYnW+kU4w1UagGB9BPMi6Y9UUAL:2nF/CH7Ntn5kU4w1tB9BPMiVkL
TLSH
T111C6BE56E2FD00E8D57AD0B8C6574927EBB234551330A7EB56A48A692F33FE06E3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 1828	5552	p.exe	89

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	10	curl/8.7.1

C:\Users\Admin\AppData\Local\Temp\p.exe
"C:\Users\Admin\AppData\Local\Temp\p.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Users\Admin\AppData\Local\Temp\p.exe
  "C:\Users\Admin\AppData\Local\Temp\p.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828

precache.db

Path C:\Users\Admin\AppData\Local\Temp\precache.db
Size 9B
SHA256 273e27da21477b39e9e99ba01524f551bb2e526874ff1d3e2a497ea25a88c333
MD5 f967f2aef32b9fe03d4f8ba955ebfb2a
SHA1 1d82ea75535bec56e472fb867e9adce27ec75bee
SHA512 65750f5d98da165b3b66079b9a9a00ab83dbb915586bc07bc17429b55d6aa2333670259a63a92b0eb6825dc7389ad9b3c229d8c7fde2a889ef32eea90dd52162
MD5 SHA1 SHA512

Submit Download

precache.db

Path C:\Users\Admin\AppData\Local\Temp\precache.db
Size 9B
SHA256 9c669e7daa1a9c4f3d941ce0ccd893682679b61e30b9187af6f41acadb3c905b
MD5 b959d309ba2c25b376b55a05f09c7ef1
SHA1 dc13e92b917fe53c29db1190c25086be79775341
SHA512 5658d52c0bfb5e9a18ff0611bf0fa945a511b40fc9feba8c7008b56f3bd50e4a6f81165c309230d433ac7f254a32196c973422143980880ae971001833ae7411
MD5 SHA1 SHA512

Submit Download

precache.db

Path C:\Users\Admin\AppData\Local\Temp\precache.db
Size 9B
SHA256 dbd65faa0374379413e5a9cabff1a4c53623be35100d84242eb7ace9edaeccac
MD5 f12914619e889a71fcb4d6f5a55965cf
SHA1 1b5ea15f886f9677624c91f92581b0d5317c880d
SHA512 67bdd6695f71bac511b0ad24f69a32fc3e8da74eb6610d05bb276b41e9b22af8a5faf429fa24be89d7212df6b3d099d961e4a4ffe44a613f0d98da5771b00d57
MD5 SHA1 SHA512

Submit Download

precache.db

Path C:\Users\Admin\AppData\Local\Temp\precache.db
Size 9B
SHA256 d3c7d2ada1228a4f4b48f999b3ed948ce1653e9abc3f8cff9c849df2628c549f
MD5 a83b2def8051d7bc50bd593c9d9c3013
SHA1 23c246a356fefe933f257c09df4d2b1637e6a2ae
SHA512 408b101e652405d4780d088e3a50935b156f37d9b1ecbcb5c22c0d8925a5517129cd78b66d4a572f2f461aaf31e2aab47c439f3a305d046a277e846d74545a24
MD5 SHA1 SHA512

Submit Download

precache.db

Path C:\Users\Admin\AppData\Local\Temp\precache.db
Size 9B
SHA256 69449ebda83055864c77fc10ef67be078c9d50056feae8e2b68e43843eca7dfb
MD5 f96a02c5d6f9372ffb17c34a4fe34d4a
SHA1 41315e4a8d89faa36475f6b093c80c172b71eefb
SHA512 2131e70bf478e563d4cf2b4d4ca03ffc71c89d883ea686a5c2b532a19fdc565fe6f8c015d13870c9a81250cd4b72f692367b7aa711069f9b5e1c17292df86242
MD5 SHA1 SHA512

Submit Download

memory/1828-11-0x0000000180000000-0x0000000180560000-memory.dmp

Download

memory/5552-0-0x0000000180000000-0x0000000180560000-memory.dmp

Download

memory/5552-5-0x0000000180000000-0x0000000180560000-memory.dmp

Download