afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:34

Target
afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
Size 3.4MB
Sample261002-e6542svejc
SHA256 afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f
MD5 53344342b7e849d77068116f09a57d56
SHA1 3f3f2c9d54c946fba6467a94c841a2d855d6268b
SHA512 9b743f26c3c0db887490a63926c4a881c631bb4e628f2848085d63f00655ad76f6b93c73c76bf4f1686eb84f18b289714fe28c3f1618ac25998d489c386bca04
SSDEEP 49152:tuaBesWZ4eT1mO4HBaAqj3/GlVzfOp0uL5lKeZ7RQeZXXoT:EggAqfKeZ7RgT
TLSH
T196F5C52AB66964D9C17BC0B8D2878F62B92070DD0B392BF345D182792F64EF96D3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3352	afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
3352	afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
3352	afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
3352	afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
3352	afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
3352	afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
3352	afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
3352	afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4320	3352	afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe	90

C:\Users\Admin\AppData\Local\Temp\afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
"C:\Users\Admin\AppData\Local\Temp\afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe
  "C:\Users\Admin\AppData\Local\Temp\afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f.exe" --exact scheduler::tests::native_child_process --ignored --nocapture
  2⤵
  PID:4320