a24dda8111f625527b9438923adcd63dd28956db3aacbcffe68dad719d2df347

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 16:49

Target
2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe
Size 3.9MB
Sample260422-vbqzmsb13p
SHA256 a24dda8111f625527b9438923adcd63dd28956db3aacbcffe68dad719d2df347
MD5 9e26ae1feb33d63d2fccca0d88daafd6
SHA1 9370404e0fee18380a89ce4804537d53d91f98d3
SHA512 648ce5933a8157a43792841bf3fb140983809baa7d6178b31aa7e90abaaeb1ac3ea8c5bb3ea7b560f8e07efcd1f4c94919e9f5354a26b4db0103811b2ec51448
SSDEEP 98304:VyWGAaDNsM9SPxH6+FLulwNA4CJ1zfNMtvrL8U4USfDNB:VjQsM9SJEw24C3fWcf
TLSH
T13116330775A994BCE219C074C75BAE737A67BD0902317CBF02E0E6701E61E865F2E785
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSync.vbs	2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe

Executes dropped EXE 1 IoCs

pid	Process
2536	WindowsUpdateSync.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2536	5092	2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Public\Libraries\WindowsUpdateSync.exe
  C:\Users\Public\Libraries\WindowsUpdateSync.exe
  2⤵
  - Executes dropped EXE
  PID:2536

WindowsUpdateSync.exe

Path C:\Users\Public\Libraries\WindowsUpdateSync.exe
Size 8.9MB
SHA256 ef3addf15e88d7e6cf74fa52d8920b3c6c0a4c8057b31aa76462562b9cf060b2
MD5 56fbdee48fa643dffa290a77638ebb70
SHA1 57c35feb11b48930444cc71aa68489a215afac04
SHA512 302a7fbf59153c3490da0b382a97dccd0d847d5dea0a5acef7d1ac82772fe2cc1c549423a6c730ecbc06d2db589ee2cc1f66b62ddef7f72b89750c7ed44b5e6b
SSDEEP 98304:jtBSrltlz6XemwcObeSGdfiAwjEbk5YWctF:jqz6XemwcOYdf1bSctF
TLSH
T1AF962847EDA145E8C0EDD63486629263BA717C494B3027D33B60FB682F77BD0AAB5350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug_sync.txt

Path C:\Users\Public\debug_sync.txt
Size 201B
SHA256 add61924e6964f35134da09d956c38dd4e58a53259a823d22924f56b93da15c0
MD5 5392fc4a3ea1d702c4bf6a4bff90a99d
SHA1 23d757e9d82c0585c1b8cb9fe8cc162411406c8c
SHA512 b5bb65abaf304deb008e4410f4c3e0544c479757cb89368326a25fe1c04ebb0ed51aaa3783b118fca32c3600fd2233e2c67f9f1ebb9680b75ab20ede82620960
TLSH
T1E6D02243046263F12E425120C213698236B2AC1D671EB022B051C9CDCA006A1B2640E0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5092-6-0x00007FF734AE0000-0x00007FF734EC1000-memory.dmp

Download