11d57b690d915fcc219916a5d790780732eccfbcf1ed63064762231ecedb9f6c

Analysis

max time kernel
299s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 06:36

Target
CelWare V.1.1.0/CelWare.exe
Size 182KB
Sample260810-hc2fjsshne
SHA256 11d57b690d915fcc219916a5d790780732eccfbcf1ed63064762231ecedb9f6c
MD5 b70593a8746712a5dda2b74a8034a00a
SHA1 c1796f6c29bf9ebde305f6480514acf1b5ef75f2
SHA512 5541ed7fafb1a45d2ef522c105370cff5f64985bf6b3d52c7fbdd36c99d340b60c5f1a61cfff3cca93550fb1d0bff92f77b1525eff84a0a3dbf2ae43197e0a2a
SSDEEP 3072:gqvmgiYSoIk8uIHzlqRwa/YB26mkIgrFk2cRjx9Dtular:g64k83TlEvGTIgY9zDtug
TLSH
T181046C07E6A850BEE1B6D679CD924C41FB7278558B71A7CF07504EB60E77AD0AE38302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	5520	CelWare.exe

Executes dropped EXE 1 IoCs

pid	Process
4512	Decompiler.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5520	CelWare.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5520	CelWare.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5520 wrote to memory of 4512	5520	CelWare.exe	89

C:\Users\Admin\AppData\Local\Temp\CelWare V.1.1.0\CelWare.exe
"C:\Users\Admin\AppData\Local\Temp\CelWare V.1.1.0\CelWare.exe"
1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Users\Admin\AppData\Local\Temp\CelWare V.1.1.0\Bin\Decompiler.exe
  "Bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:4512

Decompiler.exe

Path C:\Users\Admin\AppData\Local\Temp\CelWare V.1.1.0\Bin\Decompiler.exe
Size 9.4MB
SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
MD5 a109790efbe0542dddf63ef0415dd508
SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
TLSH
T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5520-9-0x0000017200740000-0x00000172009DE000-memory.dmp

Download