2af2d82ac1b143dc3858f394d64142b313190a8a8bf3ab5c4398c8746a700ec5

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 12:29

Target
over32.exe
Size 8.8MB
Sample260925-ppdzcassbs
SHA256 2af2d82ac1b143dc3858f394d64142b313190a8a8bf3ab5c4398c8746a700ec5
MD5 ea75dd40ca47aa5cfe4d9a39de624d37
SHA1 6bbb9e7c021085f237f9fd52cdce57ddf9c74423
SHA512 1b2943ddc0a6b9e5a19b4d75b13111fc66563e1f6b1e873e33931fe68530c5e34f2e9677e49b980fcb41938e0bc83a8e4555f8a57b86bb07b5d9ddb07d7c312c
SSDEEP 196608:n0qHSkl1364eAeVRBtSj4EymAkxLTTMfoxQoL8TzzhqmNUA0WKp0T:n6PBtSj3AkZTTCir8TzzjUArKp
TLSH
T13F9633B2638395FED266C83CC7119925BA63799147617FFF0AA80536DF9BBC32E24014
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3360	CompPkgSrv.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5284 wrote to memory of 3360	5284	over32.exe	89

C:\Users\Admin\AppData\Local\Temp\over32.exe
"C:\Users\Admin\AppData\Local\Temp\over32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe
  "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe"
  2⤵
  - Executes dropped EXE
  PID:3360

CompPkgSrv.exe

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe
Size 8.8MB
SHA256 2af2d82ac1b143dc3858f394d64142b313190a8a8bf3ab5c4398c8746a700ec5
MD5 ea75dd40ca47aa5cfe4d9a39de624d37
SHA1 6bbb9e7c021085f237f9fd52cdce57ddf9c74423
SHA512 1b2943ddc0a6b9e5a19b4d75b13111fc66563e1f6b1e873e33931fe68530c5e34f2e9677e49b980fcb41938e0bc83a8e4555f8a57b86bb07b5d9ddb07d7c312c
SSDEEP 196608:n0qHSkl1364eAeVRBtSj4EymAkxLTTMfoxQoL8TzzhqmNUA0WKp0T:n6PBtSj3AkZTTCir8TzzjUArKp
TLSH
T13F9633B2638395FED266C83CC7119925BA63799147617FFF0AA80536DF9BBC32E24014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download