3d4053cf3163b28ad66c69753b597e95b0468a9a13d6fb1b3ac8e07fe47c2dc7

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 04:38

Target
3d4053cf3163b28ad66c69753b597e95b0468a9a13d6fb1b3ac8e07fe47c2dc7.exe
Size 4.2MB
Sample260928-e9nn6swvfz
SHA256 3d4053cf3163b28ad66c69753b597e95b0468a9a13d6fb1b3ac8e07fe47c2dc7
MD5 6ba8a7aff452cddba69f7425789c0e63
SHA1 ddecd1bf0265119807a9ea9f510508600d86929a
SHA512 c0ced6dc639df27fc00f247527a4a464d8b5f6cda04427ec12d3c36984cabbacfd0a7b100eb321e443f554cb90e4cce90888f24ce23b20359fa52024dd94f8ab
SSDEEP 49152:Z8Hp+wQPHF/53jyL41aFl27DMMDV2JX9GRJUNcqXkbbMiL9Wky5H8k68T0ZOLv6n:ZD53OL41aFl2ksZcZ0uih7i0l
TLSH
T18316AE47AFA650EDC1A7C078C52A9A17FB71381D03945AFB16D0D6652F23BE02E3B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Executes dropped EXE 2 IoCs

pid	Process
4696	AppSyncCore.exe
3512	AppSyncCore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3744	3d4053cf3163b28ad66c69753b597e95b0468a9a13d6fb1b3ac8e07fe47c2dc7.exe
3744	3d4053cf3163b28ad66c69753b597e95b0468a9a13d6fb1b3ac8e07fe47c2dc7.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4696	3744	3d4053cf3163b28ad66c69753b597e95b0468a9a13d6fb1b3ac8e07fe47c2dc7.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3d4053cf3163b28ad66c69753b597e95b0468a9a13d6fb1b3ac8e07fe47c2dc7.exe
"C:\Users\Admin\AppData\Local\Temp\3d4053cf3163b28ad66c69753b597e95b0468a9a13d6fb1b3ac8e07fe47c2dc7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3744
- C:\ProgramData\AppRuntime\AppSyncCore.exe
  "C:\ProgramData\AppRuntime\AppSyncCore.exe"
  2⤵
  - Executes dropped EXE
  PID:4696

C:\ProgramData\AppRuntime\AppSyncCore.exe
C:\ProgramData\AppRuntime\AppSyncCore.exe
1⤵
- Executes dropped EXE
PID:3512

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

AppSyncCore.exe

Path C:\ProgramData\AppRuntime\AppSyncCore.exe
Size 4.2MB
SHA256 3d4053cf3163b28ad66c69753b597e95b0468a9a13d6fb1b3ac8e07fe47c2dc7
MD5 6ba8a7aff452cddba69f7425789c0e63
SHA1 ddecd1bf0265119807a9ea9f510508600d86929a
SHA512 c0ced6dc639df27fc00f247527a4a464d8b5f6cda04427ec12d3c36984cabbacfd0a7b100eb321e443f554cb90e4cce90888f24ce23b20359fa52024dd94f8ab
SSDEEP 49152:Z8Hp+wQPHF/53jyL41aFl27DMMDV2JX9GRJUNcqXkbbMiL9Wky5H8k68T0ZOLv6n:ZD53OL41aFl2ksZcZ0uih7i0l
TLSH
T18316AE47AFA650EDC1A7C078C52A9A17FB71381D03945AFB16D0D6652F23BE02E3B712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download