b952ee2a73dcf3f49db8247f7763e9f179fa10e98121881f6cdb769f772a2515

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:39

Target
2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe
Size 180KB
Sample260831-e91czavdjc
SHA256 b952ee2a73dcf3f49db8247f7763e9f179fa10e98121881f6cdb769f772a2515
MD5 c86428b51a0680577b18e5118429ceec
SHA1 8e2c905463be6240f9725db85178b3d449c336a6
SHA512 bdf5c90a259278eba01bebcafca89106375aedef4a9097061ba8555dca8dd97eae4d862dd6a6dfb9d2c509991bac6c694a7ebedee68c4217ff94567942911e35
SSDEEP 3072:iHZZp8EPmSI9eRnfRXb0IVggDSLbK9+Yd3q3jTic86j4xXQ8c:gNI9eRJoPLg9xMvic86El
TLSH
T18E04DF0AEFD358EDD09EC078B4A666B3F1B1B82A00E4EDFF6584D2374E31D605E19916
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4672 set thread context of 5536	4672	2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe	91

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 5536	4672	2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe	91
PID 4672 wrote to memory of 5536	4672	2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe	91
PID 4672 wrote to memory of 5536	4672	2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe	91
PID 4672 wrote to memory of 5536	4672	2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe	91
PID 4672 wrote to memory of 5536	4672	2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe	91
PID 4672 wrote to memory of 5536	4672	2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe	91
PID 4672 wrote to memory of 5536	4672	2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-30_c86428b51a0680577b18e5118429ceec_conti.exe"
  2⤵
  PID:5536

memory/4672-0-0x0000000140000000-0x0000000140064000-memory.dmp

Download

memory/4672-5-0x0000000140000000-0x0000000140064000-memory.dmp

Download

memory/5536-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5536-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download