d9f4c5d27b7ca6093575a929526759f17913ac602c9cdf047e878ac306eec1bf

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 04:34

Target
d9f4c5d27b7ca6093575a929526759f17913ac602c9cdf047e878ac306eec1bf.exe
Size 2.1MB
Sample261011-e65hhsv1d1
SHA256 d9f4c5d27b7ca6093575a929526759f17913ac602c9cdf047e878ac306eec1bf
MD5 c92d741a8e008c11469d76e250e70ec7
SHA1 15e8eaf8e697b9c0e444b9601714b7bf1b3ae2f7
SHA512 1fed33b168bcc2b53613eb5c1c9708212da5b9603f8910dd4f38f96c83aea2a3809c93f3dafb5afa1f9faf9edb235276f818256c118697b1bd9bb7ab93040e55
SSDEEP 49152:GI4GT6wG3ruj5mnnEUJNoHhULw0Ns7PlbfPy:GO4E4No+
TLSH
T1E9A57C0A7CE409FAD0AA633289B662917B75BC490F3227D72E60B23C3F766D49D35744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5020	d9f4c5d27b7ca6093575a929526759f17913ac602c9cdf047e878ac306eec1bf.exe
5020	d9f4c5d27b7ca6093575a929526759f17913ac602c9cdf047e878ac306eec1bf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3316	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2580	5020	d9f4c5d27b7ca6093575a929526759f17913ac602c9cdf047e878ac306eec1bf.exe	91

C:\Users\Admin\AppData\Local\Temp\d9f4c5d27b7ca6093575a929526759f17913ac602c9cdf047e878ac306eec1bf.exe
"C:\Users\Admin\AppData\Local\Temp\d9f4c5d27b7ca6093575a929526759f17913ac602c9cdf047e878ac306eec1bf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  PID:2580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3316

memory/5020-0-0x000001FCE2B60000-0x000001FCE2B61000-memory.dmp

Download

memory/5020-1-0x000001FCE2B60000-0x000001FCE2B61000-memory.dmp

Download