f47715edadb7cb981fc2b63c9625c9e683fa637f4764fa3d2607c07572b4d14a

Analysis

user interaction
yes
max time kernel
149s
max time network
107s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 03:29

Target
Noelle game.zip
Size 4.2MB
Sample260910-d15ewsfa73
SHA256 f47715edadb7cb981fc2b63c9625c9e683fa637f4764fa3d2607c07572b4d14a
MD5 cf459d75b03ec24390718b8730732dd9
SHA1 ae5c52027a180b3cdedb05686d2e6ca1d55d2bf6
SHA512 0373a564f382fbac7e619f8ff086f2059cd4e7a9546cb85c00958c16b31aab461eaba14bbb97e3f522e9d2ff0ab22d459112db5be10ed30b9163179aa6068249
SSDEEP 98304:cCfnltG8qLWmtk1Z8WGnn80oQJRmXjtvc7v6XF6dWc4+v:1ttEKeW/moviCVcWc4W
TLSH
T1131633412A8B8C05B6DC879CF4C32C12776558D4CEB6CDADDFA32310B296AE752B79C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1536	holiday.exe
1536	holiday.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Noelle game.zip"
1⤵
PID:2532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3728

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:1900

C:\Users\Admin\Desktop\Noelle game\holiday.exe
"C:\Users\Admin\Desktop\Noelle game\holiday.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1536