5c589b14d68d78bb1ff3e25a8db47299ba7f168fc204c76270edef54680d8d19

Analysis

max time kernel
899s
max time network
423s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:27

Target
b.exe
Size 37.5MB
Sample260905-tx31navyft
SHA256 5c589b14d68d78bb1ff3e25a8db47299ba7f168fc204c76270edef54680d8d19
MD5 88cc889ed3b47b0fd26f46ea2913cac9
SHA1 3217a8599c07e5b30c15cdb69c093dd7c3ba76ad
SHA512 35fcb3cd6a8cfcbbdecf83c1b567faa46567e8b53d3dd8e3c8e56ec8865eda5e15df65a42096497b116a7f7d0223d986b6b7dc28e4bece9e86fac3f96334f10e
SSDEEP 786432:ryqw9eNUvZTkZKjpeVZ/QrBk+f+qxkt9nfkcWmX3:69GcZdpeVVQryqetd863
TLSH
T1C58733D77CC062A4E1DA4A21628BD37D5092B9570EDB5C0D26C63D436F309EA2F0EDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
6168	b.exe
6168	b.exe

C:\Users\Admin\AppData\Local\Temp\b.exe
"C:\Users\Admin\AppData\Local\Temp\b.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7080

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:7160

memory/6168-0-0x00007FF73E240000-0x00007FF740234000-memory.dmp

Download