513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 21:58

Target
513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe
Size 18KB
Sample260825-1vlf6aba49
SHA256 513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc
MD5 4996c3ec609d749d6520357948fd1768
SHA1 d77e3644092171101e08cb67ca191e294e2e3699
SHA512 32ced8fc3e3d6136a10d99c6fb2f5d91b7ac6afba9569e30083841f5ace2546832ca17c8332e4bdcc6ed90943ac0525ac98b64a18b045d58438d315abe89c211
SSDEEP 384:L3pajf2NpNfjNVUxrZauhpj6OrI8L+xzscYq3W9l:1Fcxw66Tx93i
TLSH
T1CC825D4997B284E5C568CD30C37ECD29DC9AE2580362EEFB5BD58C140D9C3C27C2A966
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1212	1208	513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe	90
PID 1208 wrote to memory of 1212	1208	513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe	90
PID 1212 wrote to memory of 5864	1212	notepad.exe	91
PID 5864 wrote to memory of 1492	5864	calc.exe	94

C:\Users\Admin\AppData\Local\Temp\513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe
"C:\Users\Admin\AppData\Local\Temp\513bed0ce73d15aef999b40df6ab9e7b12e979af90ca4ee68430c95c11ca65dc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\System32\calc.exe
    calc.exe
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:1492

memory/1212-0-0x000002232E9A0000-0x000002232E9A1000-memory.dmp

Download