cafa80fb9719d446656edd6ab9eb56b4dc7f9a5adae0e1dccb5832ae7ced1040

Resubmissions

19/08/2026, 12:29

18/08/2026, 11:18

18/08/2026, 11:13

user interaction
yes
max time kernel
899s
max time network
862s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 11:13

Target
47c491f9-18df-4f17-96f2-ed6bc4b56908-1770141120789.exe
Size 8.1MB
Sample260818-nbqkjs1dkf
SHA256 cafa80fb9719d446656edd6ab9eb56b4dc7f9a5adae0e1dccb5832ae7ced1040
MD5 5fd0df817b34d6ecdc087e3461c1334c
SHA1 38af45140c3344e196c2eab92b70ebe67068cff7
SHA512 afce1eb705a3356c973ccc63d4d6ef96b1a5fd551f5e7970c4a9ea048fd8dfa87876935235b84219bf5163c9e1401508f30dd2164b29dc9576366640811e4a6a
SSDEEP 196608:0doJQ01XJKNop57ZBisLQLPH/M8xAwlCfa5TxymQIDG:0b0FJKk1BisLQLPH/MallCfRm3y
TLSH
T19586D1C7E3D8A99BC03654798901E1039EE2F4008325D3FBFBE6AD199A176E40E3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4760	WinSessionGuard.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 4760	5872	47c491f9-18df-4f17-96f2-ed6bc4b56908-1770141120789.exe	89

C:\Users\Admin\AppData\Local\Temp\47c491f9-18df-4f17-96f2-ed6bc4b56908-1770141120789.exe
"C:\Users\Admin\AppData\Local\Temp\47c491f9-18df-4f17-96f2-ed6bc4b56908-1770141120789.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Users\Admin\AppData\Local\Microsoft\Protect\WinSessionGuard.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Protect\WinSessionGuard.exe" --self
  2⤵
  - Executes dropped EXE
  PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4816

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2616

WinSessionGuard.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Protect\WinSessionGuard.exe
Size 8.1MB
SHA256 cafa80fb9719d446656edd6ab9eb56b4dc7f9a5adae0e1dccb5832ae7ced1040
MD5 5fd0df817b34d6ecdc087e3461c1334c
SHA1 38af45140c3344e196c2eab92b70ebe67068cff7
SHA512 afce1eb705a3356c973ccc63d4d6ef96b1a5fd551f5e7970c4a9ea048fd8dfa87876935235b84219bf5163c9e1401508f30dd2164b29dc9576366640811e4a6a
SSDEEP 196608:0doJQ01XJKNop57ZBisLQLPH/M8xAwlCfa5TxymQIDG:0b0FJKk1BisLQLPH/MallCfRm3y
TLSH
T19586D1C7E3D8A99BC03654798901E1039EE2F4008325D3FBFBE6AD199A176E40E3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download