Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 08:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
- Size 1.2MB
- Sample261102-kjcf4sty7k
- SHA256 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b
- MD5 94dddde1a58961bedbecb8bcf4f73d9d
- SHA1 c311a3fcd16504c435d6b1217ef0256d256e6651
- SHA512 11f633f567e492a762f3607d0568453720e1055f4e1ed05935704d30a55a579c9cf0b11dda26eaadd7709ec9b36eeeb96701ee5f3153ab47b7729b52714e7e8e
- SSDEEP 12288:RbguMWFuA62ZO0vzmEliO0vzmElvO0vzmElGO0vzmElNO0vzmElnO0vzmEl:BguMW/ZFzziFzzvFzzGFzzNFzznFzz
- TLSH T15745E10ADFDBCAD9D0BE94B9A4A560B7A261300E42D4DEDF3880915FDF719D06F28E50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 5384 wrote to memory of 3792 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 91 PID 5384 wrote to memory of 3792 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 91 PID 5384 wrote to memory of 3792 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 91 PID 5384 wrote to memory of 3792 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 91 PID 5384 wrote to memory of 3792 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 91 PID 5384 wrote to memory of 3792 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 91 PID 5384 wrote to memory of 3792 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 91 PID 5384 wrote to memory of 4168 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 92 PID 5384 wrote to memory of 4168 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 92 PID 5384 wrote to memory of 4168 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 92 PID 5384 wrote to memory of 4168 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 92 PID 5384 wrote to memory of 4168 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 92 PID 5384 wrote to memory of 4168 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 92 PID 5384 wrote to memory of 4168 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 92 PID 5384 wrote to memory of 5528 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 93 PID 5384 wrote to memory of 5528 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 93 PID 5384 wrote to memory of 5528 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 93 PID 5384 wrote to memory of 5528 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 93 PID 5384 wrote to memory of 5528 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 93 PID 5384 wrote to memory of 5528 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 93 PID 5384 wrote to memory of 5528 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 93 PID 5384 wrote to memory of 2192 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 94 PID 5384 wrote to memory of 2192 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 94 PID 5384 wrote to memory of 2192 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 94 PID 5384 wrote to memory of 2192 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 94 PID 5384 wrote to memory of 2192 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 94 PID 5384 wrote to memory of 2192 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 94 PID 5384 wrote to memory of 2192 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 94 PID 5384 wrote to memory of 2336 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 95 PID 5384 wrote to memory of 2336 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 95 PID 5384 wrote to memory of 2336 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 95 PID 5384 wrote to memory of 2336 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 95 PID 5384 wrote to memory of 2336 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 95 PID 5384 wrote to memory of 2336 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 95 PID 5384 wrote to memory of 2336 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 95 PID 5384 wrote to memory of 5572 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 96 PID 5384 wrote to memory of 5572 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 96 PID 5384 wrote to memory of 5572 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 96 PID 5384 wrote to memory of 5572 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 96 PID 5384 wrote to memory of 5572 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 96 PID 5384 wrote to memory of 5572 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 96 PID 5384 wrote to memory of 5572 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 96 PID 5384 wrote to memory of 6052 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 97 PID 5384 wrote to memory of 6052 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 97 PID 5384 wrote to memory of 6052 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 97 PID 5384 wrote to memory of 6052 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 97 PID 5384 wrote to memory of 6052 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 97 PID 5384 wrote to memory of 6052 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 97 PID 5384 wrote to memory of 6052 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 97 PID 5384 wrote to memory of 4172 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 98 PID 5384 wrote to memory of 4172 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 98 PID 5384 wrote to memory of 4172 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 98 PID 5384 wrote to memory of 4172 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 98 PID 5384 wrote to memory of 4172 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 98 PID 5384 wrote to memory of 4172 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 98 PID 5384 wrote to memory of 4172 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 98 PID 5384 wrote to memory of 5532 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 99 PID 5384 wrote to memory of 5532 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 99 PID 5384 wrote to memory of 5532 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 99 PID 5384 wrote to memory of 5532 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 99 PID 5384 wrote to memory of 5532 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 99 PID 5384 wrote to memory of 5532 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 99 PID 5384 wrote to memory of 5532 5384 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:3792
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:4168
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:5528
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:2336
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:5572
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:6052
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:4172
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:5532
-
-
C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"2⤵PID:2512
-