4165f02d09b9617ac2c3442258aa027baa32b0c4b085b142d507d134c7faf884

Analysis

user interaction
yes
max time kernel
104s
max time network
106s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 01:44

Target
OBF.exe
Size 486KB
Sample260817-b56seadk21
SHA256 4165f02d09b9617ac2c3442258aa027baa32b0c4b085b142d507d134c7faf884
MD5 02c3e4107a2e32d5d0d0bc3bfd8df267
SHA1 8cd3654b9a0d095f05b0174fe73a047ba8eb6fe1
SHA512 2ff92da4f47275659c168d7474991a39a562951bc8d899b3a9fc031f0e5595452229a37fcaae5cf11d9c943c584c27e7a7e24dacf2a411d2df22c9f832d3f61c
SSDEEP 6144:SVrHeL+9xIVJ1eAfxtpRLc9v/IaL8c0VhA4MHON9RSaHz+:SVr+acn17xsQGPHe3Hq
TLSH
T1B0B48D272DB914ECC6643AF599E0013CB3BBAC714998DB578E7439594F3AA83EC9064C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5680	ShellHost.exe

C:\Users\Admin\AppData\Local\Temp\OBF.exe
"C:\Users\Admin\AppData\Local\Temp\OBF.exe"
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1624

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004BC
1⤵
PID:3984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4660

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5680