2ece97421f71b7bfc652799add0dab2e1f9bacfe0b124b132c2d962886905ae4

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 12:19

Target
209fe9af44aa0545efe722494b7124e5.exe
Size 8.8MB
Sample261018-pg92tact3n
SHA256 2ece97421f71b7bfc652799add0dab2e1f9bacfe0b124b132c2d962886905ae4
MD5 3cc8726a2fe9dfbac118dcc1369ed062
SHA1 9f4d4ec19982917ecc393e1c261f489410072cad
SHA512 89548098370878121777714808c88890e814da00923c0ae2f222358dd23a9e4d8523cdf9888c1ac8049c80238d0984ace33671723d3afcc2a589635d548d2d41
SSDEEP 98304:KVnLvl817F7kpzeIbEghYZJN8f/TTpUfZ+I1EwUIxt:KVW1h8IuSN8XHGRtEgxt
TLSH
T1CB966B07FCA955E5C0AED2318AB69152BF717C490B2123D71B90B6382F7BBD06EB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4156	My Agent.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4156	4544	209fe9af44aa0545efe722494b7124e5.exe	89

C:\Users\Admin\AppData\Local\Temp\209fe9af44aa0545efe722494b7124e5.exe
"C:\Users\Admin\AppData\Local\Temp\209fe9af44aa0545efe722494b7124e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\My Agent.exe
  "\My Agent.exe"
  2⤵
  - Executes dropped EXE
  PID:4156

My Agent.exe

Path C:\My Agent.exe
Size 8.8MB
SHA256 2ece97421f71b7bfc652799add0dab2e1f9bacfe0b124b132c2d962886905ae4
MD5 3cc8726a2fe9dfbac118dcc1369ed062
SHA1 9f4d4ec19982917ecc393e1c261f489410072cad
SHA512 89548098370878121777714808c88890e814da00923c0ae2f222358dd23a9e4d8523cdf9888c1ac8049c80238d0984ace33671723d3afcc2a589635d548d2d41
SSDEEP 98304:KVnLvl817F7kpzeIbEghYZJN8f/TTpUfZ+I1EwUIxt:KVW1h8IuSN8XHGRtEgxt
TLSH
T1CB966B07FCA955E5C0AED2318AB69152BF717C490B2123D71B90B6382F7BBD06EB9710
MD5 SHA1 SHA512 SSDEEP TLSH