b0444263d827b458d60489eb748b231cd85769fbb44284748496c42879511242

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 22:30

Target
b0444263d827b458d60489eb748b231cd85769fbb44284748496c42879511242.exe
Size 296KB
Sample260825-2evkkazcnc
SHA256 b0444263d827b458d60489eb748b231cd85769fbb44284748496c42879511242
MD5 5a4add3cf4996de37ac1d825f531f4d1
SHA1 c460bfcfe77f8719825729008ee313bde3f9bc77
SHA512 c0e1dbbfedd31e57be4058c60ca679e46c7ead0280af412a0585c13bac05d4136029b99268f0f76b5b25f3cfe70df164b61d02026f8925af5ab15d847c0a036c
SSDEEP 3072:WuLo/2TuN+hWQVC+qxDJ6Hp2nCY+vJep8:ZoCp2nCnh
TLSH
T11D54F746DBDB5464FEFAA778997213695E33BCA00B35948F5A18707F0A31AC08E37721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 4848	2996	b0444263d827b458d60489eb748b231cd85769fbb44284748496c42879511242.exe	90

C:\Users\Admin\AppData\Local\Temp\b0444263d827b458d60489eb748b231cd85769fbb44284748496c42879511242.exe
"C:\Users\Admin\AppData\Local\Temp\b0444263d827b458d60489eb748b231cd85769fbb44284748496c42879511242.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies registry class
  PID:4848