da2f43432a3ee6821681d5d73c600b66b0b965f33afba27979c649521c13cf8a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 11:04

Target
2026-08-27_a76e6e3267a9e56ee2f48ac7b3fafca6_conti.exe
Size 146KB
Sample260827-m6hbzstdjf
SHA256 da2f43432a3ee6821681d5d73c600b66b0b965f33afba27979c649521c13cf8a
MD5 a76e6e3267a9e56ee2f48ac7b3fafca6
SHA1 af75f2bcc3863104ea5bd35263bef4ea59e0c153
SHA512 b2f190149f6bd6757c174f64586da09f8177e0154e6230fa5994ac42dc8fd902ad53eef166e49d5e5333c7e1b0604db12acb56cefe1338ff3aee8a5206a0dc73
SSDEEP 3072:kEmtW7hlTk04+rttV/CGdDb7mL3imzd5ve31b:Xk03/CGdDb7mL3imzbve31b
TLSH
T1AAE39F5CA7F3C3CAF40FA4F45251EA28EDDBBD0742BCADF1C581A670DE926E45168842
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1340	WinLocker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1340	WinLocker.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 1340	4192	2026-08-27_a76e6e3267a9e56ee2f48ac7b3fafca6_conti.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-27_a76e6e3267a9e56ee2f48ac7b3fafca6_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_a76e6e3267a9e56ee2f48ac7b3fafca6_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\WinLocker.exe
  "C:\Users\Admin\AppData\Local\Temp\WinLocker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1340

WinLocker.exe

Path C:\Users\Admin\AppData\Local\Temp\WinLocker.exe
Size 23KB
SHA256 13b623f43ade31fd989df3f0b29840a40e618e015290c2f38cd0eda12394e298
MD5 c94542a9e08782cf6e4e6f950776521c
SHA1 9108c5aa69f9fb8b907928c9a9591d1e6aba0f08
SHA512 5ef4735e44b96b5458718b756bd3fa0db5bafdd36bf45c9acf2c6ec33de3d6a7bd94eadabb3aa61802e22f944097d010535da4e530a55599c80455951f6035f7
SSDEEP 384:T5ZxdHCb+mpgQwdcgUTbB+mPeRDsb43dw+WFlW5CW:TXxUam/tg8b4eeRDU6wlhW
TLSH
T131B2D75AF35360EDE6A6C0B0E5EB4B73E175FC21067A6B3A2744D2392E70C97992D403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1340-5-0x00007FF791550000-0x00007FF79155D000-memory.dmp

Download

memory/4192-4-0x00007FF6BFB40000-0x00007FF6BFB6C000-memory.dmp

Download