bdf0d7ac7478fc79460d7806bffc889ff195ffcb6c3684d03ec89636f69407ad

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 13:03

Target
catalyst.exe
Size 1.7MB
Sample261102-qaccmsct5m
SHA256 bdf0d7ac7478fc79460d7806bffc889ff195ffcb6c3684d03ec89636f69407ad
MD5 e303c7677f4a98862c34bc354994b9c4
SHA1 37ef5614e485139fc03aa31ca4b783a4e482f39d
SHA512 5894738ad5291ddea948f26623a83a15e33f71c8bc8beed081d620a9e64885e9f8d66068d6b8fe86b4ac39fc0dc218d414973ba7436f6db71d9c2a423ebc1b08
SSDEEP 24576:sVoDKpbp7lh5PBWP1+FG/AJ5zRapmFZ1h0lhSMXlgXA6mL1kGO:sl5jJhDJlROhCmL/
TLSH
T162858D51E78EC2D9C92DA4BC5622D707E33070022F1587CF67AA1D569E27EE05EBEB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5096	catalyst.exe
5096	catalyst.exe

C:\Users\Admin\AppData\Local\Temp\catalyst.exe
"C:\Users\Admin\AppData\Local\Temp\catalyst.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4304