ffbfda2b701f97bc5124e626234c848564185f6133ffaf007d87b94b99360c62

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 00:12

Target
crypted.exe
Size 11.1MB
Sample260814-ahn4ea1ekc
SHA256 ffbfda2b701f97bc5124e626234c848564185f6133ffaf007d87b94b99360c62
MD5 4914c844e5d94672827bb63f7c4fd19e
SHA1 5f0c52881f0e6dc9789c5c7a563b348428074428
SHA512 9b4c937315cb1c02b6fb5529f1fba5d99faf2de969fb404069992574bbe0e061dfe69efcfb7085dc7dcbf83f921a97e2e26b7d771f0df14f4095348876915aeb
SSDEEP 24576:m3cszoA9pP1y27ZXYCRkJmVq2PLiNdssBq0vL4KZceRVlQ:m3cszdnYCwmsaiNdsaj4KZcey
TLSH
T1B1C66A17AFDC13FCE627C3FC8A959232E2F174410761AADB1655D7193E23AE06E3A211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 5996	2696	crypted.exe	87
PID 2696 wrote to memory of 5996	2696	crypted.exe	87

C:\Users\Admin\AppData\Local\Temp\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\crypted.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:5996

memory/2696-0-0x0000000000810000-0x0000000000811000-memory.dmp

Download