cb53a147ce93dbe5c7bb9a583d66a9f285906b89e21af6db57cdec57e384c729

Analysis

user interaction
yes
max time kernel
898s
max time network
432s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 23:25

Target
AegisShell.exe
Size 4.7MB
Sample260809-3ehrfach92
SHA256 cb53a147ce93dbe5c7bb9a583d66a9f285906b89e21af6db57cdec57e384c729
MD5 9cc758d9f97a8ec1fd62efb586ea909d
SHA1 a6676892c3d21feaa2115e02d004f141b29643b9
SHA512 658543dcc2c91f26a2f5c3a1452146b16c4a1ca7bef9db4450b0266619516015075729176d39b6bc2bad2833d535820867a3db14cab80f45d38392955f42d277
SSDEEP 49152:MbD0l4QnjVwG4SzvBJtd0EY7Lgx+//UZIRIW5bJT7OIuT7eT7e9bVroKJeq048gb:a+Rw7SzvX/yUU/UbD8ER
TLSH
T1BA367D02B75ADAADC01BC470835692735A26B0CB0F35A9FF55C855383F6AAF05F38369
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1236	AegisShell.exe

C:\Users\Admin\AppData\Local\Temp\AegisShell.exe
"C:\Users\Admin\AppData\Local\Temp\AegisShell.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4708