67ef675d2dafa85f4d9ba5d573f1271eee63f45ab0298c865a440e5a30643574

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:30

Target
pterm.exe
Size 636KB
Sample261027-e437nsbt9k
SHA256 67ef675d2dafa85f4d9ba5d573f1271eee63f45ab0298c865a440e5a30643574
MD5 c5b29030e75fd2e8ab9ea8044f70b101
SHA1 6ae1577f66059ba2b05e4c4ea9d2b08ebcfbef68
SHA512 ac19204c8286376aaaa74377db5931d870f66c4d785c0d710b1b23b280df0cf739a918edbc946ee7850e5f1c4d60e8deaa7a52941403cc2f8abbef08cbe78a2b
SSDEEP 12288:eLcXSR9+zTE/s6o7WWBnb7i90d2w9tXF1OdfNRR:eLcXSH1U6CWWBnb7wyPaj
TLSH
T1E9D4AE55B3E504FDE27B8139C9A28623FB7174161721ABDF07A086662F37AD41F3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4292	pterm.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4128	4292	pterm.exe	90
PID 4292 wrote to memory of 3020	4292	pterm.exe	91

C:\Users\Admin\AppData\Local\Temp\pterm.exe
"C:\Users\Admin\AppData\Local\Temp\pterm.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 24 --signal 0x314 --server 0x30c
  2⤵
  PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3020