8b5a9143f26a50e80bb37d02fa7b6dcbf155dee67af9d3d24e9d7d8cc5b41af2

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 08:10

Target
SeroLocker.exe
Size 2.3MB
Sample260823-j2ztpavckd
SHA256 8b5a9143f26a50e80bb37d02fa7b6dcbf155dee67af9d3d24e9d7d8cc5b41af2
MD5 01b5dcea33a1a48101ec1346e4883621
SHA1 bce9d977de13e5b41e27e13e33e8a29df6e598f4
SHA512 6e7e2dd7db433c5bf9dd7a11dab72f0b1a7c85b5a65f7f99fa46cf03383acd412270990dc7615c8aa93a7a01d14ae2023dc899d158bcbdb3d53ec6c6ddd8215c
SSDEEP 24576:bacs+s+3FOLE2gl7212oUoS5KEUHZskwEHEJkJ0gf+MhA:b1FOLE/c2oUB5pUHZ75lmMW
TLSH
T143B5B70BF7B611D1E0BAC0399553222BFC7134A6833897EBA6C59E461B61BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 1320	724	SeroLocker.exe	89

C:\Users\Admin\AppData\Local\Temp\SeroLocker.exe
"C:\Users\Admin\AppData\Local\Temp\SeroLocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:1320

memory/724-0-0x00007FF667E10000-0x00007FF668150000-memory.dmp

Download

memory/724-1-0x00007FF667E10000-0x00007FF668150000-memory.dmp

Download