67cc75a522c6a2886bd806da5a654b2698e2ca87a011b739f13b37dac35230b1

Resubmissions

14/08/2026, 23:54

14/08/2026, 23:53

user interaction
yes
max time kernel
20s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:54

Target
R6-Dumper.exe
Size 30.7MB
Sample260814-3xt77avwhy
SHA256 67cc75a522c6a2886bd806da5a654b2698e2ca87a011b739f13b37dac35230b1
MD5 7d4af5f8acbe15a51441f646d3894dda
SHA1 853c71a64941d88b98d0b3ca645d45876bd6c0e6
SHA512 5109be2d742a6b93750d9926e76f34b5d327943daa390092d47d797bd3ec02b3de751cd4bba893f39c5d60dfb5d4ccda7cf13a9e3ffa3b7360ff06c9c91337ac
SSDEEP 786432:C0L4S1PoQOvURRT1z7mpJ4g+IsABkD/8Jh3:C0sS1PoaRx1HE4jIsABkK
TLSH
T1C56723E6A9CD23D0C7C31A00618E43AB61D1957941FE9C292BC73C026B15EEF664AF77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4964	R6-Dumper.exe
4964	R6-Dumper.exe

Suspicious behavior: LoadsDriver 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3272	ShellHost.exe

C:\Users\Admin\AppData\Local\Temp\R6-Dumper.exe
"C:\Users\Admin\AppData\Local\Temp\R6-Dumper.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004FC
1⤵
PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4260

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3272

memory/4964-0-0x00000001409F7000-0x0000000141AD1000-memory.dmp

Download

memory/4964-1-0x00000001409F7000-0x0000000141AD1000-memory.dmp

Download