43fc6c662ccc311c86ce8ca5728f2c9aab825b00ce54a50f8f2036c3166bb8bb

Analysis

user interaction
yes
max time kernel
900s
max time network
462s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 23:11

Target
gxkrnl.exe
Size 4.6MB
Sample260825-26qexsbb55
SHA256 43fc6c662ccc311c86ce8ca5728f2c9aab825b00ce54a50f8f2036c3166bb8bb
MD5 920b5f14b44facde309fbb5af32f7822
SHA1 42eaeedb55074241b401b2c753441e550d57a5d0
SHA512 def1416ac94e48d6cd2e1da3986d0ffc399a6b8c2afe673bf907cd76d15eafc2366b7b7db5307e5455f8c9a2ecfa429fcf2e82a2ce644c90ef42d01217d67ac2
SSDEEP 98304:n1isRAHEw20ZcqFrAGXIkB1CZKaa0e1BlYY0ZuGcyli8iCLzA4lN:1iM5d0JKE1Csaa0e7l00Rqi8i+zAiN
TLSH
T1C5262389B48619FCD116D3F0DD6238FE732637C385B71E4A36896A00AAD353C917639A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2396	gxkrnl.exe
2396	gxkrnl.exe

C:\Users\Admin\AppData\Local\Temp\gxkrnl.exe
"C:\Users\Admin\AppData\Local\Temp\gxkrnl.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5284

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4980

memory/2396-0-0x0000000140285000-0x00000001404FE000-memory.dmp

Download