3f49ff89c1c9504a27e4cf4fb74a80580e84f8609b551f500cb6b91855bb4472

Analysis

user interaction
yes
max time kernel
208s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 15:16

Target
skybound_cracked.exe
Size 187KB
Sample260913-snkmaaydpc
SHA256 3f49ff89c1c9504a27e4cf4fb74a80580e84f8609b551f500cb6b91855bb4472
MD5 b77067cc1cb1019341b57f464fbe2977
SHA1 a63b60ce7086bdad9e8f103a844b1fc149ef2155
SHA512 3e226ab6acd6fd94f627cd0d3b8f7835c6a950ea5b4b392e26eea83aa0cb5a2876b816f25d46fef6cf1eae90cb09020324674abc9481853e24046fd52cf6d970
SSDEEP 3072:5C54ezLlIDHvq7FKPfAkmyWpxwJAXsy4:5PezLlqHvqRKPfAT5N
TLSH
T171147D17B62141F9E40BC07483599573B63670CA1F2169FF16B806382EA9EF97F38B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 4352	1160	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\skybound_cracked.exe
"C:\Users\Admin\AppData\Local\Temp\skybound_cracked.exe"
1⤵
PID:5924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1552

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\skybound_cracked.exe
  skybound_cracked.exe
  2⤵
  PID:4352