06151545deac3429cac5acff0111f5763542277b603d8847b24beb1f3ebd045a

Analysis

user interaction
yes
max time kernel
100s
max time network
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:50

Target
cowork-svc.exe
Size 12.1MB
Sample260809-vcrybsam3s
SHA256 06151545deac3429cac5acff0111f5763542277b603d8847b24beb1f3ebd045a
MD5 8065e2d56f6b66c28acb84b1a8b15b04
SHA1 f734f18c474ac20c6cc38fccd904abfe94f5f83d
SHA512 d3ecb8260bdddb0eaa7e7f8129f2d039dde693943ecde2b5d7484ef319fa676c72e92328dd32dbb06927d7c47115e94761afe972f94d79b46d1e9c94e322e4bc
SSDEEP 98304:8Kz9kM86DlttQx8sX7mOc93FOd1RlZ0K63wPY9sExV7:8KvDlnQxvX75c9sd1rZ09gwxN
TLSH
T1A8D64907E8A544E5C4E9D5348A669262BB727C485B3037D73B60F7382FB3BD06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	cowork-svc.exe
2796	cowork-svc.exe

C:\Users\Admin\AppData\Local\Temp\cowork-svc.exe
"C:\Users\Admin\AppData\Local\Temp\cowork-svc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796