92827841c0753ded07353f9d14b983b5720740fb556b948a7a2b43bd22e7e323

Analysis

max time kernel
39s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 03:38

Target

vxlang.exe
Size

8.8MB
MD5

e5f7bc79431508e6ad375d7331a67631
SHA1

332969414d9d2fc467709e18e28d4240f118e9ef
SHA256

92827841c0753ded07353f9d14b983b5720740fb556b948a7a2b43bd22e7e323
SHA512

e1b14f33a7434abf7eeb2f5cc0456cf8570811b2e4047400b34e65188c58d885dec2dff5fce4d35025f8e509bdb1d31b7df4ecfa1ed113dc7cb7c0eaef997dbc
SSDEEP

196608:43YD7Xq8L3aM1teIetKAWmCr3cifGlvA5zidXDFqz89VOl:4a7Xq8rakSVY9cI5zidzO89E

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 32 IoCs

Suspicious behavior: EnumeratesProcesses 26 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 964	2392	vxlang.exe	92
PID 2392 wrote to memory of 964	2392	vxlang.exe	92
PID 2392 wrote to memory of 3988	2392	vxlang.exe	93
PID 2392 wrote to memory of 3988	2392	vxlang.exe	93

C:\Users\Admin\AppData\Local\Temp\vxlang.exe
"C:\Users\Admin\AppData\Local\Temp\vxlang.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\vxlang.exe
  "C:\Users\Admin\AppData\Local\Temp\vxlang.exe" --axion-id:46cc5f94cecb3e50
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Users\Admin\AppData\Local\Temp\vxlang.exe
  "C:\Users\Admin\AppData\Local\Temp\vxlang.exe" --axion-id:3425dfc8376b3e50
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

memory/2392-0-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-3-0x000001D723900000-0x000001D723930000-memory.dmp

Filesize
192KB

Download
memory/2392-4-0x000001D723840000-0x000001D723841000-memory.dmp

Filesize
4KB

Download
memory/2392-5-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-6-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-8-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-10-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-12-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-13-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-14-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-16-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-18-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download
memory/2392-20-0x00007FF6F4B20000-0x00007FF6F615C000-memory.dmp

Filesize
22.2MB

Download