dc49d8cfc59f95e993c00a45b0899ff2bc4c008e2031ec73880934adceba2661

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:41

Target
dc49d8cfc59f95e993c00a45b0899ff2bc4c008e2031ec73880934adceba2661.exe
Size 44KB
Sample260930-r2pygstsa1
SHA256 dc49d8cfc59f95e993c00a45b0899ff2bc4c008e2031ec73880934adceba2661
MD5 7c925661745cb0d63e6233384ec41ce7
SHA1 07b73c033497d17e73a62abe5f05842f55b3aa8a
SHA512 f118353a421e94308a98213cd1af78cf6d865f905a9192849fe8684c653be400d820578cfa17c7553bcce7def4cebe78bb96cfbeae67e29fdd9bd134221039f8
SSDEEP 192:IxVX898+JCUD3DIrQHSwQMx1TTbutP7+wuBYiKLRZqKVnU:IxVMnlTcomlfUYiKLRZqKV
TLSH
T1B41343A5AF998486E671A23CDCFA83307B3DFAD907A287D74508B5325D127C06DF8702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1832	1500	dc49d8cfc59f95e993c00a45b0899ff2bc4c008e2031ec73880934adceba2661.exe	84

C:\Users\Admin\AppData\Local\Temp\dc49d8cfc59f95e993c00a45b0899ff2bc4c008e2031ec73880934adceba2661.exe
"C:\Users\Admin\AppData\Local\Temp\dc49d8cfc59f95e993c00a45b0899ff2bc4c008e2031ec73880934adceba2661.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Users\Admin\AppData\Local\Temp\dc49d8cfc59f95e993c00a45b0899ff2bc4c008e2031ec73880934adceba2661.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4784