14663e375d5e067e9ec18643926d9c9a38c4e9ec7abc7bde651c0d2a269cbbc4

Analysis

user interaction
yes
max time kernel
898s
max time network
483s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:24

Target
launcher.exe
Size 237KB
Sample260809-w168latcpg
SHA256 14663e375d5e067e9ec18643926d9c9a38c4e9ec7abc7bde651c0d2a269cbbc4
MD5 7b6dc47609df02c44422f05f5b0879ad
SHA1 2454c8034c9ea6b0d8845e5ce71acdb91d610c8d
SHA512 c7520512c7be7216f8db1f6a03c9496bfa48cf347affe3739af6d0cb8daf60799d0d9ce8c202aca93d273765dc2aed493638307d0ec1a9b720415b6e515bbaeb
SSDEEP 3072:YiW9fG/DPZaWbtwEoKoEH5JmSKKxph0LR/hSMXlk4ZqKFya5XB67TTtz7RMFyLnu:hW9MsK/730Szph0lhSMXlBXBWnx7RMU
TLSH
T14A34AF12F7A6DCF9E60886B588570B44EB337C808382E7CF175499925F679D25F3BA02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2220	AllServices_module_v2.0.1.exe
2220	AllServices_module_v2.0.1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	AllServices_module_v2.0.1.exe
2220	AllServices_module_v2.0.1.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2220	2724	launcher.exe	85

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\AllServices_module_v2.0.1.exe
  "AllServices_module_v2.0.1.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1980