5d4ec5b61e1becf7bb3745a073f0d9031450e28c581d649d0ba1394df4703653

Analysis

user interaction
yes
max time kernel
119s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 12:02

Target
Bin/fa91bc37d6e8.exe
Size 77KB
Sample260808-n7vjdawemb
SHA256 5d4ec5b61e1becf7bb3745a073f0d9031450e28c581d649d0ba1394df4703653
MD5 dd6d432633069a2f98499ebea3824775
SHA1 2e3fc3bcd68fc2388faea91a9735dea4652f6420
SHA512 8fcc1cd98540596f6e7d8ac8b2f95dee6af54d179305b5143be97077fd1232808d3bf0fdcdf42d7c7a80079d010adf21743cc5e9004796164c2c33c9fd088371
SSDEEP 1536:iR8cAOfEPhn93JPmSNS7oQdBRyo7Z9zgoAm13scsEA:q8csZn93JPFS7o6R7D18csEA
TLSH
T1B173EA258D5950EAD33A9978C8172C06FF51B8854B926BCB6B005ED31E23AD8AF3F301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1220	fa91bc37d6e8.exe
1220	fa91bc37d6e8.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 3024	1220	fa91bc37d6e8.exe	81

C:\Users\Admin\AppData\Local\Temp\Bin\fa91bc37d6e8.exe
"C:\Users\Admin\AppData\Local\Temp\Bin\fa91bc37d6e8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\Bin\Decompiler.exe
  Decompiler.exe serve
  2⤵
  PID:3024