684466fea122489847604232dab1058d02e843f23bf4898faa538b92ad041b91

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/08/2026, 01:03

Target
Private Slotted Internal.exe
Size 25.4MB
Sample260822-berwkadh95
SHA256 684466fea122489847604232dab1058d02e843f23bf4898faa538b92ad041b91
MD5 061603cf371c0c829633954f04a9abe0
SHA1 da7ce0a5ba8f569f02d0c08daaea0521c2a4825a
SHA512 f7bef7ef909a0be01cc3fc0a502571f8411f66694f10fe81a1d221eeab31805a477a9bf214eac09311f076c5f6344d2b9f4700fc0506e984c52e1290f3ba57d2
SSDEEP 786432:eF9fssQ0hlOibz9+pLSNYvTbURLWGVdS24:eF6YOiVHNePUlWgR4
TLSH
T1FA4723D3A5D562D8D3938E0492CB638B83C1756BDAD7D71D38C6A8032521DC79B82E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5008	Private Slotted Internal.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5008 set thread context of 4892	5008	Private Slotted Internal.exe	81

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4892	5008	Private Slotted Internal.exe	81
PID 5008 wrote to memory of 4892	5008	Private Slotted Internal.exe	81
PID 5008 wrote to memory of 4892	5008	Private Slotted Internal.exe	81
PID 5008 wrote to memory of 4892	5008	Private Slotted Internal.exe	81
PID 5008 wrote to memory of 4892	5008	Private Slotted Internal.exe	81
PID 5008 wrote to memory of 4892	5008	Private Slotted Internal.exe	81
PID 5008 wrote to memory of 4892	5008	Private Slotted Internal.exe	81

C:\Users\Admin\AppData\Local\Temp\Private Slotted Internal.exe
"C:\Users\Admin\AppData\Local\Temp\Private Slotted Internal.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Users\Admin\AppData\Local\Temp\Private Slotted Internal.exe
  "C:\Users\Admin\AppData\Local\Temp\Private Slotted Internal.exe"
  2⤵
  PID:4892

memory/4892-0-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4892-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4892-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4892-4-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5008-3-0x0000000140000000-0x00000001428E7000-memory.dmp

Download

memory/5008-6-0x0000000140000000-0x00000001428E7000-memory.dmp

Download