9715fadd2e7c16e7bab1ac783303ad761107e8048e89b807974b82c35386a0d5

Analysis

user interaction
yes
max time kernel
57s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 01:00

Target
Private Slotted Emulator.exe
Size 3.7MB
Sample260822-bctblsel6z
SHA256 9715fadd2e7c16e7bab1ac783303ad761107e8048e89b807974b82c35386a0d5
MD5 3aedb035bde80bca1130aef0cda40c39
SHA1 bf0d1011431c8e7da6d7ca2194026a6f03134e32
SHA512 c75216d8dd7c2bb089914cf76d2ed31f5b4f3df20146e98ee5c808b5a408a156b13d8b7a2e8ebaff4bc02b62bddccb040784de9da6bccc87d31fed523943ce41
SSDEEP 98304:khPm8M3h6AwK7SVn6j98EzmBmhzA2ZpXGP:0+1h6AwK7SVn6j9FmBmhzA2ZpXG
TLSH
T12906AE4AB3F801F8D17BC138C656960BE7B274551360A7DF13A086A96F23BE16B3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4380 set thread context of 1548	4380	Private Slotted Emulator.exe	89

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4380	Private Slotted Emulator.exe
4380	Private Slotted Emulator.exe
4380	Private Slotted Emulator.exe
4380	Private Slotted Emulator.exe
4380	Private Slotted Emulator.exe
4380	Private Slotted Emulator.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4380	Private Slotted Emulator.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4380	Private Slotted Emulator.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 1548	4380	Private Slotted Emulator.exe	89
PID 4380 wrote to memory of 1548	4380	Private Slotted Emulator.exe	89
PID 4380 wrote to memory of 1548	4380	Private Slotted Emulator.exe	89
PID 4380 wrote to memory of 1548	4380	Private Slotted Emulator.exe	89
PID 4380 wrote to memory of 1548	4380	Private Slotted Emulator.exe	89
PID 4380 wrote to memory of 1548	4380	Private Slotted Emulator.exe	89
PID 4380 wrote to memory of 1548	4380	Private Slotted Emulator.exe	89

C:\Users\Admin\AppData\Local\Temp\Private Slotted Emulator.exe
"C:\Users\Admin\AppData\Local\Temp\Private Slotted Emulator.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\Private Slotted Emulator.exe
  "C:\Users\Admin\AppData\Local\Temp\Private Slotted Emulator.exe"
  2⤵
  PID:1548

memory/1548-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1548-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4380-0-0x0000000140000000-0x00000001403E2000-memory.dmp

Download

memory/4380-3-0x0000000140000000-0x00000001403E2000-memory.dmp

Download