2ce9644ec398f5307f3886dc15d83b8dd89f3ed59281177839e5a738f2b7ff5c

Analysis

user interaction
yes
max time kernel
30s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 12:44

Target
interface.exe
Size 506KB
Sample260810-pyl2bayfld
SHA256 2ce9644ec398f5307f3886dc15d83b8dd89f3ed59281177839e5a738f2b7ff5c
MD5 19162b2bf1a0ae15a205191bff27d2d2
SHA1 802ee8386e2a1724ea64ddfc9ce4125580bf38ed
SHA512 305fed234480d7cf98a8ee67079fed109a5fc011c859ab149dfbc54585cf0415d1fe1d24814161ba06ed9c4fa7b66b375b470bb7865acf6ebb7e298e1db1fc53
SSDEEP 6144:gFuEFPkOOtPwbbzc2QS9aNDpSO5ZY1PZFI8XllrVxSY7UgijnDLTAjnbOkj:queZzbaNHZYFE8XDvTijnDnAj6w
TLSH
T16EB49D16F1A847FCD16B9178965BAA0BFA35348907205DCF33D808992FE27F456BBB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3716	interface.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2104	3716	interface.exe	82

C:\Users\Admin\AppData\Local\Temp\interface.exe
"C:\Users\Admin\AppData\Local\Temp\interface.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -u "C:\Users\Admin\AppData\Local\Temp\valogen2_deps_check.py"
  2⤵
  PID:2104