8062e2048491ac749de6bda8c001cf0078a694bdcac3230b5157f08b48db6263

Analysis

user interaction
yes
max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rdtsc_check.exe
Size 62KB
Sample261012-yleadaas5p
SHA256 8062e2048491ac749de6bda8c001cf0078a694bdcac3230b5157f08b48db6263
MD5 7ad192a2adac95f321167b17831759e1
SHA1 842c3298b2dae61ca57e3fb89e3838f11da9a940
SHA512 6436466c5f73c118ace079d056ba7585e28f4a33bccdc3db686df6ef571297691e41a706fbffacbe962474e43fd6638b2662329d54ff14e7def12136a308eeb0
SSDEEP 768:1zNXubsoYtWlsgUAtcsiw5iyV+Ro8rBcNCW4c7O40s2XV2sUC:1pXVDgUA551YrBcNT+9s2X/UC
TLSH
T1205341E57ED99CC7E964637862E9D231363DFAD08A434B07952026321E13FD07ED92CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3368	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3368	1196	rdtsc_check.exe	89

C:\Users\Admin\AppData\Local\Temp\rdtsc_check.exe
"C:\Users\Admin\AppData\Local\Temp\rdtsc_check.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x00007FF6DB3B0000-0x00007FF6DB3C6000-memory.dmp

Download