d286314ddc725e145e70206eff6c47bcb5f4ccb8021d8e09bafdb784cefa8185

Analysis

user interaction
yes
max time kernel
8s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 14:06

Target
SacredStep_BETA.exe
Size 393KB
Sample260807-repdfaztbv
SHA256 d286314ddc725e145e70206eff6c47bcb5f4ccb8021d8e09bafdb784cefa8185
MD5 01a53b11abb91dccb779593e05bfc3d6
SHA1 bc8a3db6405b7e32e6997060d171cdb0764b20a1
SHA512 94f5ff7128a41ff0063ec221bf6f69a6e451c80a40cf95a582fe4c10704a673b70edf024aebbdacfbc80584ccadabe02ea7d6e54dcb244c7e913a57cc9209105
SSDEEP 12288:ZJaJMaDvv3EunYGkeOyl4J64RgVFJyKuL+:ZJaiW3JnTJOyl4FqH/
TLSH
T13884E14272E831FCF5B36ABAC7810A04AB76FD3617254BEF4764E2275E536C19C3A604
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3708	run_58487d8.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3708	3036	SacredStep_BETA.exe	86

C:\Users\Admin\AppData\Local\Temp\SacredStep_BETA.exe
"C:\Users\Admin\AppData\Local\Temp\SacredStep_BETA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\SacredStep\run_58487d8.exe
  "C:\Users\Admin\AppData\Local\SacredStep\run_58487d8.exe"
  2⤵
  - Executes dropped EXE
  PID:3708

run_58487d8.exe

Path C:\Users\Admin\AppData\Local\SacredStep\run_58487d8.exe
Size 256KB
SHA256 716dab463bebd8cc4df6a5736305dd55b534c1713440ad449c22090541e7ecce
MD5 8a19a1d70b720631fa7bd7d542dc5c89
SHA1 72e09ddea184dd67aec7d5f83230994f31dbf806
SHA512 47770355bcf04fda984fca0a0e5363e60de358c7e25989189c6f65ca4056c43414870cdebd6b4883dc34363f50ef521c6a9824a9b19a87c9a045c50e3c5c492c
SSDEEP 6144:iSvXthHX3gIn7R+o1ON2w7bKEBbagwu7v7J0I3BRX5:R/n3Ht6KEBugBv72KB
TLSH
T144447C14FBA50CF9E967C57DCA429905EB737C410361EADB03908AA65F33AD49E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download