f5c7a823b6188ad45c1f3b58e5fb59359b6f62624848478c6029dadb38ddf8d2

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 12:17

Target
eden.exe
Size 58.2MB
Sample261030-pgalysywcy
SHA256 f5c7a823b6188ad45c1f3b58e5fb59359b6f62624848478c6029dadb38ddf8d2
MD5 2b80af1d3794c7f1b98a68f04645ef98
SHA1 25293a30a05edf99ba2a527b50449739a0773b5f
SHA512 01182d8034af84b1c5b7e1b4f8b7a6fe1fd85d9d894279485baafb995f21fecd7ec07d7be018469181469f284e2ad8b9ed1c2d56c1faaf88dede6e031d5bf17c
SSDEEP 786432:UtgRIctqfQh6zCfLGeRwLq1qVhbDZG7tq1q:UtgRIctqfQh6zCfLGeRUq1qDDGq1q
TLSH
T134D79D16B6AA10AAE8BBC474C7579623EB71348A1B309ADF069457692F377F01F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1308	eden.exe
1308	eden.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4496	1308	eden.exe	88

C:\Users\Admin\AppData\Local\Temp\eden.exe
"C:\Users\Admin\AppData\Local\Temp\eden.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\eden.exe
  C:\Users\Admin\AppData\Local\Temp\eden.exe
  2⤵
  PID:4496