a24dda8111f625527b9438923adcd63dd28956db3aacbcffe68dad719d2df347

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 16:49

Target
2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe
Size 3.9MB
Sample260422-vbqzmsb13p
SHA256 a24dda8111f625527b9438923adcd63dd28956db3aacbcffe68dad719d2df347
MD5 9e26ae1feb33d63d2fccca0d88daafd6
SHA1 9370404e0fee18380a89ce4804537d53d91f98d3
SHA512 648ce5933a8157a43792841bf3fb140983809baa7d6178b31aa7e90abaaeb1ac3ea8c5bb3ea7b560f8e07efcd1f4c94919e9f5354a26b4db0103811b2ec51448
SSDEEP 98304:VyWGAaDNsM9SPxH6+FLulwNA4CJ1zfNMtvrL8U4USfDNB:VjQsM9SJEw24C3fWcf
TLSH
T13116330775A994BCE219C074C75BAE737A67BD0902317CBF02E0E6701E61E865F2E785
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSync.vbs	2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe

Executes dropped EXE 1 IoCs

pid	Process
696	WindowsUpdateSync.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 696	5004	2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_9e26ae1feb33d63d2fccca0d88daafd6_akira.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Public\Libraries\WindowsUpdateSync.exe
  C:\Users\Public\Libraries\WindowsUpdateSync.exe
  2⤵
  - Executes dropped EXE
  PID:696

WindowsUpdateSync.exe

Path C:\Users\Public\Libraries\WindowsUpdateSync.exe
Size 8.9MB
SHA256 ef3addf15e88d7e6cf74fa52d8920b3c6c0a4c8057b31aa76462562b9cf060b2
MD5 56fbdee48fa643dffa290a77638ebb70
SHA1 57c35feb11b48930444cc71aa68489a215afac04
SHA512 302a7fbf59153c3490da0b382a97dccd0d847d5dea0a5acef7d1ac82772fe2cc1c549423a6c730ecbc06d2db589ee2cc1f66b62ddef7f72b89750c7ed44b5e6b
SSDEEP 98304:jtBSrltlz6XemwcObeSGdfiAwjEbk5YWctF:jqz6XemwcOYdf1bSctF
TLSH
T1AF962847EDA145E8C0EDD63486629263BA717C494B3027D33B60FB682F77BD0AAB5350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug_sync.txt

Path C:\Users\Public\debug_sync.txt
Size 201B
SHA256 3777355a07d01be576a18506f4b4175ccdef0a7e8d084ea4f87254902385459f
MD5 b8d54b5714fd6a4ded8c3d562bf71630
SHA1 b64c2645b4726adb3ed64b91f65d801ddeac574b
SHA512 34f21a36a7e93fd123177be71a274e670e3fc75dd27b3dcf39d1c0829a0ba47b2c2d4e9d14b9a9d4feaf799134d3b730e660f82fb03a345478cbe1196cd09c14
TLSH
T173D02283446463F12F825120C21369823AB2A00D771EB02EB081C98DCA00671B2640E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5004-8-0x00007FF703C90000-0x00007FF704071000-memory.dmp

Download