048a81c85634dda3af122d671b847bf081a6f0aefc552aa02ee8d2868fe02ac3

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MemoriaPlayerLauncher.exe
Size 5.5MB
Sample260924-qbkqeaeb53
SHA256 048a81c85634dda3af122d671b847bf081a6f0aefc552aa02ee8d2868fe02ac3
MD5 0e72a6657c8451c9be177bb2fb2487f5
SHA1 259d7dafa63b6049a6ce912f2c3fb22f17c6771f
SHA512 179166673788090e715264c058492dc60bb898120720acb821b820e8864133150e4a3166ad266d98b3a3ee4d7407d143d09e6e558e8f0ce55d8f064325703dab
SSDEEP 98304:DrbUJsSh/9NeBkC3EjMqAy7Xe6b0+su5L:b4N1x7wE5
TLSH
T16546AF03F391C1ECC05AC1748356A233EA73F8894B35B2AB6BC45B216E66B909F1D75D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-player\URL Protocol	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-player\shell\open	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-studio\DefaultIcon	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Memoria.StudioFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\" \"%1\""	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.memoriarbxm\ = "Memoria.StudioFile"	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-player	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-player\DefaultIcon	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-studio\ = "URL:Memoria Protocol"	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Memoria.StudioFile	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Memoria.StudioFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\",0"	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Memoria.StudioFile\shell\open\command	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Memoria.StudioFile\shell	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-studio\shell\open\command	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-studio\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\" \"%1\""	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-player\shell	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-studio\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\",0"	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-studio\shell	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-studio\shell\open	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Memoria.StudioFile\DefaultIcon	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Memoria.StudioFile\shell\open	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.memoriarbxm	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-studio	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Memoria.StudioFile\FriendlyTypeName = "Memoria Studio File"	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.memoriarbxm\OpenWithProgids\Memoria.StudioFile	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-player\ = "URL:Memoria Protocol"	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-player\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\",0"	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Memoria.StudioFile\ = "Memoria Studio File"	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.memoriarbxm\OpenWithProgids	MemoriaPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-player\shell\open\command	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\" \"%1\""	MemoriaPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\memoria-studio\URL Protocol	MemoriaPlayerLauncher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1400	MemoriaPlayerLauncher.exe

C:\Users\Admin\AppData\Local\Temp\MemoriaPlayerLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\MemoriaPlayerLauncher.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-0-0x00007FF700910000-0x00007FF700E99000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads