cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911

Analysis

max time kernel
28s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 18:05

Target
oxide-stub.exe
Size 8.9MB
Sample260924-wpjcdsswcy
SHA256 cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911
MD5 4d046ee5a3ae9d162197a04c7b14d681
SHA1 c7138d9027ed0f7ff9f00606731d88bb7293adb0
SHA512 7a791165a31ea32500616406464194fb871d9f306c36b61c307be5d50b2237e75ac778b5bbb03ea8a78813055857968784104629e4db3e2ef28478d5b7a545fa
SSDEEP 196608:gP5WwmDLLv2Qk2ucNYlaPA0m5evUV8Q6AxlGR/:gIBDLLlkv0m0U+Q6Axla/
TLSH
T1D4963340724915F8F67B56BC6D801A83A7B6B4052733AAFF3AD513E91F229D04E36B34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4984	CompPkgSrv.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4984	2988	oxide-stub.exe	85

C:\Users\Admin\AppData\Local\Temp\oxide-stub.exe
"C:\Users\Admin\AppData\Local\Temp\oxide-stub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe
  "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe"
  2⤵
  - Executes dropped EXE
  PID:4984

CompPkgSrv.exe

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe
Size 8.9MB
SHA256 cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911
MD5 4d046ee5a3ae9d162197a04c7b14d681
SHA1 c7138d9027ed0f7ff9f00606731d88bb7293adb0
SHA512 7a791165a31ea32500616406464194fb871d9f306c36b61c307be5d50b2237e75ac778b5bbb03ea8a78813055857968784104629e4db3e2ef28478d5b7a545fa
SSDEEP 196608:gP5WwmDLLv2Qk2ucNYlaPA0m5evUV8Q6AxlGR/:gIBDLLlkv0m0U+Q6Axla/
TLSH
T1D4963340724915F8F67B56BC6D801A83A7B6B4052733AAFF3AD513E91F229D04E36B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download