24ae15795636c00d6c095d92e887398c257f949077fb5a5e37c0e75d2d2cd11b

Analysis

user interaction
yes
max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 19:57

Target
OverwolfLauncher.exe
Size 1.9MB
Sample260808-ypg6fatelf
SHA256 24ae15795636c00d6c095d92e887398c257f949077fb5a5e37c0e75d2d2cd11b
MD5 6d5b60a4cb15015333d67622c2610f87
SHA1 633df184fcdb177508eefbba26ef26cd4ba77d31
SHA512 a141dd356926ea394ad11aba9e31121b97db19635562def12b82cd5549cd9b9c674cfa87cca92189f66c43589e6b9b588bc21d72ddfe463185abe9a14ce04d24
SSDEEP 49152:aIh8BP59+FTlM95TjP2m/RdtiZX9A0Q8Aj+hXB5k:aF59+5iPP2adI00Q
TLSH
T1BB958D1AF7A801F8D16BC27889968617F7B278150B718BDF12A1176E2F336E15E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1488	2164	OverwolfLauncher.exe	89

C:\Users\Admin\AppData\Local\Temp\OverwolfLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\OverwolfLauncher.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\OverwolfLauncher.exe
  -cs
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488