513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 21:58

Target
513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe
Size 18KB
Sample260825-1vlf6aba49
SHA256 513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc
MD5 4996c3ec609d749d6520357948fd1768
SHA1 d77e3644092171101e08cb67ca191e294e2e3699
SHA512 32ced8fc3e3d6136a10d99c6fb2f5d91b7ac6afba9569e30083841f5ace2546832ca17c8332e4bdcc6ed90943ac0525ac98b64a18b045d58438d315abe89c211
SSDEEP 384:L3pajf2NpNfjNVUxrZauhpj6OrI8L+xzscYq3W9l:1Fcxw66Tx93i
TLSH
T1CC825D4997B284E5C568CD30C37ECD29DC9AE2580362EEFB5BD58C140D9C3C27C2A966
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1940	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 2992	4356	513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe	86
PID 4356 wrote to memory of 2992	4356	513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe	86
PID 2992 wrote to memory of 3756	2992	notepad.exe	87

C:\Users\Admin\AppData\Local\Temp\513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe
"C:\Users\Admin\AppData\Local\Temp\513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\System32\calc.exe
    calc.exe
    3⤵
    - Modifies registry class
    PID:3756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1940