dc7864161b7fe1096761a0ebebc7637c2cfe3347b7f588e8de7ee08974e0c133

Analysis

user interaction
yes
max time kernel
83s
max time network
72s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/09/2026, 22:25

Target
agent-d740.exe
Size 13.6MB
Sample260925-2b33jayajf
SHA256 dc7864161b7fe1096761a0ebebc7637c2cfe3347b7f588e8de7ee08974e0c133
MD5 628b1f4df55fd8be337f21032bc500ee
SHA1 e80c6adae1566836bd6c16fe6781020927729b2c
SHA512 c70f313d851bd72c96842446f804dd22a6ad627da9cbecba23651456bc6edc5d0e8d025292369ba896b7f1c6ca5b9ad09a1249754644034a6a8af305333b11ea
SSDEEP 49152:yw3KpH588wczXV3Of1si9oxMmaewYPHFXtE46zI2Ck7zecNB02KU4rToIgic4RZm:yw34ZBw2I
TLSH
T1BFE61207ECA428F6C1AEA231497755567BB1BC481F2163D75E90B2B92FB3BC09C76B04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
2272	047a0cwahr.exe
2936	asd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 2272	3196	agent-d740.exe	83
PID 2272 wrote to memory of 2936	2272	047a0cwahr.exe	84

C:\Users\Admin\AppData\Local\Temp\agent-d740.exe
"C:\Users\Admin\AppData\Local\Temp\agent-d740.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\joavfyvyxjbap7\047a0cwahr.exe
  C:\Users\Admin\AppData\Local\Temp\joavfyvyxjbap7\047a0cwahr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\asd.exe
    "C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\asd.exe"
    3⤵
    - Executes dropped EXE
    PID:2936

047a0cwahr.exe

Path C:\Users\Admin\AppData\Local\Temp\joavfyvyxjbap7\047a0cwahr.exe
Size 8.7MB
SHA256 44d50de51bd537f306bbcc607172b7fbc0ca3b21605bcdca5b32ffd1aa340ffd
MD5 6dc849cec90113022894195d9d5f44de
SHA1 1ff4839fc6dcdc78bd160065dc17daf0b9a1ffdf
SHA512 99aebc502a463fd92c68b84c022dd7bd88d5278665116ca79a773be7bba2d387665a5264f46a395796b19d0e174cbaa50a9f1a901bba892960197c6d38f3b3c2
SSDEEP 98304:+hVVVgv2oqp6dEEGmf4EKz87O6vV4QAiDd/ubI:+VCK6OtmfFKYK6Dd/L
TLSH
T148967B03ECA558E9C4AED23086729552BB71BC490B2123D71FA0FB283F76BD46DB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2272-4-0x00000002A1770000-0x00000002A177E000-memory.dmp

Download

memory/2272-28-0x00007FF676B40000-0x00007FF679456000-memory.dmp

Download

memory/2936-30-0x00007FF7D68D0000-0x00007FF7D91E6000-memory.dmp

Download