78caecb11818c08e699a22b553e0fd536c7a8d4a8a5b11746bc8cc0e52c37249

Analysis

user interaction
yes
max time kernel
19s
max time network
5s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 20:26

Target
feather.exe
Size 5.1MB
Sample260808-y72mssdk5y
SHA256 78caecb11818c08e699a22b553e0fd536c7a8d4a8a5b11746bc8cc0e52c37249
MD5 b2a7423e054bd0bc589dacb91d92024c
SHA1 04dbbdd28784cd9a2fcd6c7181dcca03e77e2bfb
SHA512 916a517008384ba9ae83dc9328665ee7fc88075206507c8de468e1d3a262402af263363987c07ed89e94c1ce39aa89ea70d3fb8fff968d7a588889a78f8f2ae6
SSDEEP 98304:VuM+6Wjrfew+8Ir6ChuNEWRP/A2GnZK0sO:VuM+6WjTPoW94hnZKBO
TLSH
T184468926A6346ACCAA5AB5FCFF431473D716F38106CB936593F1F04AB8C3B5E9988501
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4148	Feather_Runtime.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4148	2560	feather.exe	89

C:\Users\Admin\AppData\Local\Temp\feather.exe
"C:\Users\Admin\AppData\Local\Temp\feather.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\Feather_Runtime.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather_Runtime.exe"
  2⤵
  - Executes dropped EXE
  PID:4148

Feather_Runtime.exe

Path C:\Users\Admin\AppData\Local\Temp\Feather_Runtime.exe
Size 5.0MB
SHA256 bb0a8ef22387d2e27080d0cc3bc4c8f3bb5f086f71f986d8eb7a5bb9939bfefa
MD5 6f430127f810dd9d205dd6ad8347a559
SHA1 3c7bb41a70959b5680cef6d660b55d170992349c
SHA512 d801034d1eef7fe67dde0391470427dbf3ac2e363141ceda2575ce44c28dcccf14c599497a2794f322c1158a9218c0542a184c4ad4ff9eeeabf83ae284cd5e4c
SSDEEP 98304:9zpJOGYHcn05uo/Y7mgTm05AwJHE6hvkTlZqL9PlF:08Gg7PAmks6ZqL1lF
TLSH
T1F836BE42B392C5E9C166C138CA52D7A7D7323C090F2166EB329C7A1E6F736E04E7A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download