ebdbb98c3efb974d578b8101bded084612b22eed37a11d9343bb17b84d4bdb5a

Analysis

user interaction
yes
max time kernel
4s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 08:10

Target
Vortix External.exe
Size 1.1MB
Sample260427-j22chsd181
SHA256 ebdbb98c3efb974d578b8101bded084612b22eed37a11d9343bb17b84d4bdb5a
MD5 9a7894455b41ff8346803dca870f5af4
SHA1 0f75285b91053d8e5af094ba8b4f32175d58728d
SHA512 72225f334a0a8c05b1055f2268a29c7f01c66e49d0365316ed04ad5f0398a6cf58e01e4c5a98488f47032cbb11d23f5549065141dd11777b65e73776ab25e787
SSDEEP 24576:vSeFZcgE6qOri7o/nsfh5Z5U1iHn5QwhuwHU:vSeHgu0o/nSFHn5bq
TLSH
T13445AE45B2F540F8D4BB9138CA66951FEA713C450B304AEB13E44A5A3FA3BE05BBB711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4440	Vortix External.exe
4440	Vortix External.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3820	4440	Vortix External.exe	80
PID 4440 wrote to memory of 3116	4440	Vortix External.exe	81

C:\Users\Admin\AppData\Local\Temp\Vortix External.exe
"C:\Users\Admin\AppData\Local\Temp\Vortix External.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:3116