edad5164fac7773b834f86fc9dc4ea18310fb7926f7b63a3120060554dbe3617

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 09:21

Target
file.exe
Size 1.9MB
Sample260825-lbc84swvc1
SHA256 edad5164fac7773b834f86fc9dc4ea18310fb7926f7b63a3120060554dbe3617
MD5 570ecadea98d02ae407c82dfd34e2adc
SHA1 efa885025d6be2fc75a433f0e415494f1616eba7
SHA512 5c157014b107caa0bcfd5bd6e4df42da58d070b7981eb6ba236844e9eecf27fda1a7c5acb00bd2d33455e1a4893cc0159e7acc338ac18771b2a455ff11c02a9b
SSDEEP 49152:jbJWzUdC4/4Cs1FzrHpohlrPcuLG8pqDVp/X:jbI4/4CiN6bPfLG8pqDb
TLSH
T14495128FE75206F6D53994B894115202FEA1BC560B204FEF2720AD776D63EE86F39720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4908	Widgets.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4908	2196	file.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Widgets\Widgets.exe
  "C:\Users\Admin\AppData\Local\Widgets\Widgets.exe"
  2⤵
  - Executes dropped EXE
  PID:4908

Widgets.exe

Path C:\Users\Admin\AppData\Local\Widgets\Widgets.exe
Size 1.5MB
SHA256 a489ebaa9a3869f6faa0e64a8fc00aabb6ad764aa87d8b1089e102e01bf9c889
MD5 d9c95caa97b170cfc9de54f3b099b67a
SHA1 7e749c85b5e7e91e5061f41fcd4d6f5dd5a79d32
SHA512 4fa4ed0ceedacb69dfc7028d2cc3ef2e24e7ba7a2c9196f914b552caa729802c7bcfa6358b09d6e4a2bd294384fbcafd17733fb7cddcc5c7234da49c84ebde65
SSDEEP 24576:wNbG9I9G9x4b+mnCo/FSd64RMnf3KI7Z7mD0U2:jI9M46Ik6EMnk0
TLSH
T16D65AF1B679402E5D13B92BD99D68B82F9B1B80507309EDB11661DE82E17EFD0F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download