3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 10:33

Target
3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe
Size 306KB
Sample260820-mlz2ascg32
SHA256 3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8
MD5 259a15c6d91f39b893212d7f0bca033f
SHA1 6031bc77cb1d1cb6bada9a02907a219c0f85c37e
SHA512 1e08115a821322ef6a6a1d578cba0e9832c5d7a7bd31cbc26fa88d6174af7fffc5ca0f0015ab430ed0e33195648a3a55c4e0d380bc5e07c0d85f4d8ae3c2ec0c
SSDEEP 6144:MT9yO7sITYNmYn+yInRU+Wi+StbaoJLQXBuA6H3RJoPLg9xMvic86El:OsITYgYn+NyuA6HPO0vzmEl
TLSH
T1A1649D0BFFAAC5A8D0BE817865925513F375340A1360D7CF3690426EEF76AD0AE39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 1716	1160	3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1716	1160	3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe	89
PID 1160 wrote to memory of 1716	1160	3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe	89
PID 1160 wrote to memory of 1716	1160	3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe	89
PID 1160 wrote to memory of 1716	1160	3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe	89
PID 1160 wrote to memory of 1716	1160	3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe	89
PID 1160 wrote to memory of 1716	1160	3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe	89
PID 1160 wrote to memory of 1716	1160	3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe	89

C:\Users\Admin\AppData\Local\Temp\3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe
"C:\Users\Admin\AppData\Local\Temp\3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe
  "C:\Users\Admin\AppData\Local\Temp\3160346b016065224dd70056288dcdce7cf4c070ed0116f71bc24e2ea3d6cad8.exe"
  2⤵
  PID:1716

memory/1160-0-0x0000000140000000-0x0000000140081000-memory.dmp

Download

memory/1160-4-0x0000000140000000-0x0000000140081000-memory.dmp

Download

memory/1716-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1716-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download