2e6490ec4f2e995d6076a3758fea7470e24fbda923fa12fe2efc14b798cdab70

Analysis

max time kernel
898s
max time network
475s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/10/2026, 08:14

Target
server_win.exe
Size 50.5MB
Sample261027-j422tsda69
SHA256 2e6490ec4f2e995d6076a3758fea7470e24fbda923fa12fe2efc14b798cdab70
MD5 d7d2f51c1fb7e4bc3ffd53f1b9c77afe
SHA1 28c67518ec5c1cdb5068527543891c6d22cdcc0a
SHA512 63d4172f3f10ea7c36b364ce0e8d03151a29d9f0d7c59f0450edf0fe5e1a03114f4d8c3bc9d38a807f66652cc8276c04484c6a374ba4f4c55f1f1771f8aa7a8c
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:sMguj8Q4Vfv/qFTrYp0g
TLSH
T111C78C1372E600A6E5B79235879B5103EB72B45B57309BCB318C03251FABFE4AA7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4708	tray_windows_release.exe

Loads dropped DLL 1 IoCs

pid	Process
4708	tray_windows_release.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4708	4300	server_win.exe	82

C:\Users\Admin\AppData\Local\Temp\server_win.exe
"C:\Users\Admin\AppData\Local\Temp\server_win.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\.cache\node-systray\1.0.5\tray_windows_release.exe
  C:\Users\Admin\.cache\node-systray\1.0.5\tray_windows_release.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4708

tray_windows_release.exe

Path C:\Users\Admin\.cache\node-systray\1.0.5\tray_windows_release.exe
Size 4.4MB
SHA256 680fa8a6658ac2e2e15208d91629201032248056c7e3768f576bf98c9bb6f9d6
MD5 900089e6ab13cc8f80e115674ff2c8f8
SHA1 3ace61f7b81309e7304a2bae71495ce87b7b75a7
SHA512 ad316c05765b851bdc7a88285a65b9a6d3668f27c869a0132f48e7fbac64ce2012c4dcd2d7b99819dd492faeacc44fd4bfa33fad2e3f0db4f374f025f5d05d6a
SSDEEP 49152:/hmPyEboDIhg0rbK9pSSCJxdfUr7A2GRcMD07YdOFkg/Ymc2qgIvD0qTQ:sFoDEhKGD0kdY22pIxQ
TLSH
T16126F913F8E714FAD17FE1308692A322BA76346583317B939F9046991A26FE47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systrayamd64.dll

Path C:\Users\Admin\AppData\Roaming\systray\systrayamd64.dll
Size 108KB
SHA256 b4a66c8a25ea63409c65cadd1b55e041970e48cd35e2965fc78fc99c005beafd
MD5 9bf30d7ae5b2bc2d57e4b725e86a5149
SHA1 bfdbee659100fddcaa8db7f367b3681474ba9b16
SHA512 990d49441c6fca8e3be563b69c1baf465ecb04ed71ef8b42602f27044fe183b07f3cdf5f169fbe51caa05131b571e10830b41bdef809e92713486cb9b1e33432
SSDEEP 1536:ZmqKn52/gcVWgzJwANtl9ArkymhsQxjFjzkgZMqsWu6d7B9dlv3kfSAQ:EBn52/gAVhHIrkymhsrwM1AVd3CSA
TLSH
T1A4B35C5BB3E000BBE5B68739C4671916E772B8120671DB5F07A443562F237A2AD3BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download