3f964e0a2ac190b19783eef43f59842f79e1552399cb1a06609b391854b44ef7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:22

Target
2026-08-08_f9daba9a062ce2e6e6a931f6ab1cb2e7_conti.exe
Size 259KB
Sample260808-ctnm5abb76
SHA256 3f964e0a2ac190b19783eef43f59842f79e1552399cb1a06609b391854b44ef7
MD5 f9daba9a062ce2e6e6a931f6ab1cb2e7
SHA1 f505774b930f7f578b06aff6f92ed2a87beba959
SHA512 e9c528445377c4478f888231b9645a1ae418de1da4cd0fa53875726bd52363f6a93bdc2a0b052472b426d249f32a1f1a97f5e208414acdc2b03b010cb88614f8
SSDEEP 3072:DqLpItnVEjuYHyZA6mptb3NdzBTN8vzAN5GMaERnYk+DgeI0C3Si3kgzRfIxmFb6:DqBF6mpt0eiE1RMA049UgtJb1mWBO
TLSH
T1ED4402CBD26B30BEC35BD6B1C0D3DB70E57AB52202517D7A6108C7783D16D9A4F29A22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1928	4924	2026-08-08_f9daba9a062ce2e6e6a931f6ab1cb2e7_conti.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f9daba9a062ce2e6e6a931f6ab1cb2e7_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f9daba9a062ce2e6e6a931f6ab1cb2e7_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe"
  2⤵
  PID:1928

memory/1928-2-0x0000028960950000-0x000002896099C000-memory.dmp

Download

memory/4924-0-0x000001DB62060000-0x000001DB62061000-memory.dmp

Download

memory/4924-1-0x00007FF65C2C0000-0x00007FF65C309000-memory.dmp

Download