67bc906f53178ef648583252c0059b91c1c23bedbb245edd3fe93ea12105b94c

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.7MB
Sample261022-myldnset2n
SHA256 67bc906f53178ef648583252c0059b91c1c23bedbb245edd3fe93ea12105b94c
MD5 63d6ede8d285ca4ee2d5983cba3c2275
SHA1 34dd1a13203075c3ff729c44f6880641ce4c96b8
SHA512 75eb7b381f0c8044c09a3a1660a7262a4d2eac6ee3e876c67f65583294025d497764832edfb8e1581ef45a75a66427d5ef917c5e6d79d9c1689ff49a85d310af
SSDEEP 49152:6UEXeQerJJaOIOaLsURbqyoVi27biYQug1IjhJ+6mglbevW7pgqD:6Pb+2OIOOJB272lVujOvAtD
TLSH
T1FE36232EB72761DEC797533090A963B2FD1D5F2071449D3A8240E1BE3EB2C6E65E12E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5012	GoogleUpdate.exe

Executes dropped EXE 2 IoCs

pid	Process
996	GoogleUpdate.exe
5012	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 996	5844	file.exe	89
PID 5844 wrote to memory of 5012	5844	file.exe	90

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5844
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  C:\ProgramData\Google\Update\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  "C:\ProgramData\Google\Update\GoogleUpdate.exe" -d "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\ProgramData\Google\Update\GoogleUpdate.exe
Size 2.3MB
SHA256 10ea14091f6ac287062e8634533fc1912fa7c9d5bb5347f049356f729d1d3914
MD5 24bffa2824284bec13ab5d48ed3fb1fa
SHA1 f89a29f7574e26e4ddf163f85ace5b5d1fabfd92
SHA512 f680c98bb02e14b541ba96d459819f4c97793033be45000c2a2a354a086a12b671a10ae90de34d47d6bc4ff9715cb18a0cfba6202663c8dec485f67034f77642
SSDEEP 3072:VF4zFfpre6qA0hR37geD2n5/ApKfDfzakJP5L5Pxkd2Du5HlM7oOMQMc:VqFhezhRUoMDOkJP5L5Pxe5HlkoqMc
TLSH
T10DB5D03BF76380EAC68792B0E59E6AE1F829BD6410608C3D435481BC3F7BD691DD5AC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-11-0x00007FF68C2A0000-0x00007FF68C3A1000-memory.dmp

Download

memory/5012-12-0x00007FF68C2A0000-0x00007FF68C3A1000-memory.dmp

Download

memory/5844-6-0x00007FF739970000-0x00007FF739ABE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads