3f964e0a2ac190b19783eef43f59842f79e1552399cb1a06609b391854b44ef7

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:22

Target
2026-08-08_f9daba9a062ce2e6e6a931f6ab1cb2e7_conti.exe
Size 259KB
Sample260808-ctnm5abb76
SHA256 3f964e0a2ac190b19783eef43f59842f79e1552399cb1a06609b391854b44ef7
MD5 f9daba9a062ce2e6e6a931f6ab1cb2e7
SHA1 f505774b930f7f578b06aff6f92ed2a87beba959
SHA512 e9c528445377c4478f888231b9645a1ae418de1da4cd0fa53875726bd52363f6a93bdc2a0b052472b426d249f32a1f1a97f5e208414acdc2b03b010cb88614f8
SSDEEP 3072:DqLpItnVEjuYHyZA6mptb3NdzBTN8vzAN5GMaERnYk+DgeI0C3Si3kgzRfIxmFb6:DqBF6mpt0eiE1RMA049UgtJb1mWBO
TLSH
T1ED4402CBD26B30BEC35BD6B1C0D3DB70E57AB52202517D7A6108C7783D16D9A4F29A22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 124 wrote to memory of 1200	124	2026-08-08_f9daba9a062ce2e6e6a931f6ab1cb2e7_conti.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f9daba9a062ce2e6e6a931f6ab1cb2e7_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f9daba9a062ce2e6e6a931f6ab1cb2e7_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:124
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe"
  2⤵
  PID:1200

memory/124-0-0x000001E1F0150000-0x000001E1F0151000-memory.dmp

Download

memory/124-1-0x00007FF6EBA70000-0x00007FF6EBAB9000-memory.dmp

Download

memory/1200-2-0x0000014806590000-0x00000148065DC000-memory.dmp

Download