14663e375d5e067e9ec18643926d9c9a38c4e9ec7abc7bde651c0d2a269cbbc4

Analysis

max time kernel
900s
max time network
462s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:24

Target
launcher.exe
Size 237KB
Sample260809-w168latcpg
SHA256 14663e375d5e067e9ec18643926d9c9a38c4e9ec7abc7bde651c0d2a269cbbc4
MD5 7b6dc47609df02c44422f05f5b0879ad
SHA1 2454c8034c9ea6b0d8845e5ce71acdb91d610c8d
SHA512 c7520512c7be7216f8db1f6a03c9496bfa48cf347affe3739af6d0cb8daf60799d0d9ce8c202aca93d273765dc2aed493638307d0ec1a9b720415b6e515bbaeb
SSDEEP 3072:YiW9fG/DPZaWbtwEoKoEH5JmSKKxph0LR/hSMXlk4ZqKFya5XB67TTtz7RMFyLnu:hW9MsK/730Szph0lhSMXlBXBWnx7RMU
TLSH
T14A34AF12F7A6DCF9E60886B588570B44EB337C808382E7CF175499925F679D25F3BA02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5568	AllServices_module_v2.0.1.exe
5568	AllServices_module_v2.0.1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5568	AllServices_module_v2.0.1.exe
5568	AllServices_module_v2.0.1.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 5568	1840	launcher.exe	90

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\AllServices_module_v2.0.1.exe
  "AllServices_module_v2.0.1.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3356

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4744