1656bc679d7f617bb8ec482eff2ffea11eb3f7a5ec38c72c3ffb32e785af2f6f

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 09:16

Target
ter.exe
Size 770KB
Sample260808-k8mclscf89
SHA256 1656bc679d7f617bb8ec482eff2ffea11eb3f7a5ec38c72c3ffb32e785af2f6f
MD5 b663b6eee658ff35b0ddb056312b5812
SHA1 3dea4f99b4820b40bb8394dd2ec869cdf3037462
SHA512 de52e2d98b218b7c6a8acc5e3e91315f710abc442064ee171d6f770a51db8990d052479588a16f53dd3519acd7d7d4c2d84c9dce9ad78ad2a49dcf5a31a31887
SSDEEP 6144:eWu6SURwVE/kYzWii8Aow9AwBmOK8Q0Y3JhFAzY/Of+ejmTqj9HSxjNVuhHvsPp8:v3NwpBm3Jkdj9jlC2hOoANmsJxYGbY
TLSH
T1DBF43B11BE5A49A5E099C8B4834B86639A3678CB0F3AB4FF00C551393F7DAB55F3D218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	ter.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2284	ter.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3156	2284	ter.exe	85
PID 2284 wrote to memory of 1020	2284	ter.exe	86

C:\Users\Admin\AppData\Local\Temp\ter.exe
"C:\Users\Admin\AppData\Local\Temp\ter.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --width 108 --height 29 --signal 0x214 --server 0x210
  2⤵
  PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1020