dc7e855342aae5e14d3c022f63ff76ab70e993b3bccb764d01aab49b322cd3bc

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 13:59

Target
dc7e855342aae5e14d3c022f63ff76ab70e993b3bccb764d01aab49b322cd3bc.exe
Size 133KB
Sample260820-rafwhaybqe
SHA256 dc7e855342aae5e14d3c022f63ff76ab70e993b3bccb764d01aab49b322cd3bc
MD5 3dbb70fc9a436eaf3ba92f11454e80d6
SHA1 a88da0162458fe1c0224ea2d4fb12fa16f45d34c
SHA512 662509fb7e4967d48b60969a134673af2ef172df1dca59912a72003c8d3247ddf5636c48042364bab84bd473351b7c4615f3d9abf687c9c795cb369de90ff5e8
SSDEEP 3072:Zssw+r3J2QAxZLvW1mS4wfsQFHQBlaHP0EUQE:ZRr3JwDu134tAQBAHP0EUQE
TLSH
T117D35A02F3A394BCC516C034C6C76636F2327C990730BAAF57A45E326E16A91BB3DD59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
864	DE196954.exe
4532	DE196954.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5544 wrote to memory of 864	5544	dc7e855342aae5e14d3c022f63ff76ab70e993b3bccb764d01aab49b322cd3bc.exe	89
PID 864 wrote to memory of 4532	864	DE196954.exe	90

C:\Users\Admin\AppData\Local\Temp\dc7e855342aae5e14d3c022f63ff76ab70e993b3bccb764d01aab49b322cd3bc.exe
"C:\Users\Admin\AppData\Local\Temp\dc7e855342aae5e14d3c022f63ff76ab70e993b3bccb764d01aab49b322cd3bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Users\Admin\AppData\Roaming\DE196954.exe
  C:\Users\Admin\AppData\Roaming\DE196954.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Users\Admin\AppData\Roaming\DE196954.exe
    "C:\Users\Admin\AppData\Roaming\DE196954.exe" -w
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4532

DE196954.exe

Path C:\Users\Admin\AppData\Roaming\DE196954.exe
Size 133KB
SHA256 dc7e855342aae5e14d3c022f63ff76ab70e993b3bccb764d01aab49b322cd3bc
MD5 3dbb70fc9a436eaf3ba92f11454e80d6
SHA1 a88da0162458fe1c0224ea2d4fb12fa16f45d34c
SHA512 662509fb7e4967d48b60969a134673af2ef172df1dca59912a72003c8d3247ddf5636c48042364bab84bd473351b7c4615f3d9abf687c9c795cb369de90ff5e8
SSDEEP 3072:Zssw+r3J2QAxZLvW1mS4wfsQFHQBlaHP0EUQE:ZRr3JwDu134tAQBAHP0EUQE
TLSH
T117D35A02F3A394BCC516C034C6C76636F2327C990730BAAF57A45E326E16A91BB3DD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/864-3-0x00007FF651490000-0x00007FF6514BA000-memory.dmp

Download

memory/864-7-0x00007FF651490000-0x00007FF6514BA000-memory.dmp

Download

memory/864-11-0x00007FF651490000-0x00007FF6514BA000-memory.dmp

Download

memory/864-21-0x00007FF651490000-0x00007FF6514BA000-memory.dmp

Download

memory/4532-4-0x00007FF651490000-0x00007FF6514BA000-memory.dmp

Download

memory/5544-1-0x00007FF62EB20000-0x00007FF62EB4A000-memory.dmp

Download