cd6fd23d52e273bb26ec7936c5f81e29e48b1e1b9fd3d519ec056a9f806be949

Analysis

user interaction
yes
max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
outlook.exe
Size 741KB
Sample260808-b61yjsfn81
SHA256 cd6fd23d52e273bb26ec7936c5f81e29e48b1e1b9fd3d519ec056a9f806be949
MD5 ba62221511df34efe741746bfc2d8d06
SHA1 db1f748bb8148a91961e06c54ea4d4f71a3bd1f0
SHA512 761d4d0244992412efa8d08e949821e1a04440199cba4583efc4ff925b37e196f219d9fb6715741b78f8b472e8878c30f42c372e6517efb04fb1ed7f937bd05b
SSDEEP 12288:ypEGPMsur8SyPxZyNjn7iCZ4gbAFx4eEHQ1M7WILOO:iEzyPTyp5ZFcF+HQ1MxCO
TLSH
T104F47D2AAB6801BCE1B7C1B9CE164943E7B17849037169EF07D05AA62F176D44B3FF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5020	cmd.exe
5528	cmd.exe
3216	cmd.exe
108	cmd.exe
3596	cmd.exe
6004	cmd.exe
2796	cmd.exe
4712	cmd.exe
1124	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 5020	5532	outlook.exe	90
PID 5532 wrote to memory of 5528	5532	outlook.exe	91
PID 5532 wrote to memory of 2796	5532	outlook.exe	92
PID 5532 wrote to memory of 3216	5532	outlook.exe	93
PID 5532 wrote to memory of 108	5532	outlook.exe	94
PID 5532 wrote to memory of 4712	5532	outlook.exe	95
PID 5532 wrote to memory of 3596	5532	outlook.exe	96
PID 5532 wrote to memory of 6004	5532	outlook.exe	98
PID 5532 wrote to memory of 1124	5532	outlook.exe	99

C:\Users\Admin\AppData\Local\Temp\outlook.exe
"C:\Users\Admin\AppData\Local\Temp\outlook.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads