12f27975401cd9e423c13c78e202f0a3dc9c437988de838af935437d15631671

Analysis

user interaction
yes
max time kernel
149s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 03:53

Target
Vise (1).exe
Size 1022KB
Sample260511-efrhzaet5j
SHA256 12f27975401cd9e423c13c78e202f0a3dc9c437988de838af935437d15631671
MD5 452dadbb19862e394a7bc18fa347441c
SHA1 58f52b7c789b950a5569f7719b4631f19846123b
SHA512 1a22425cdfeda2d3f752a9a91c6003709d259cd5ab788ea8ae366520cc58bafd01057ac7308dbf5969e0b855aeb7397beb2a32cc14e5f369e9c9e81b102528ae
SSDEEP 24576:BIYvI5yd9k4Y3z1GtxNST/XpZEpXlqBgtJ2PCZFl6b0UlQAMp:eGd9kVeSF41qBgtJ2PCZFl6b0UqAS
TLSH
T13825AF1A67A405E9C1B7D17CC6578617E7B270090371EBEF06E086A52F23BD16B3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1120	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 5004	3332	Vise (1).exe	86
PID 5004 wrote to memory of 5020	5004	cmd.exe	87
PID 5004 wrote to memory of 1080	5004	cmd.exe	88
PID 5004 wrote to memory of 5068	5004	cmd.exe	89
PID 3332 wrote to memory of 4708	3332	Vise (1).exe	91
PID 4708 wrote to memory of 2568	4708	cmd.exe	92
PID 2568 wrote to memory of 1120	2568	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\Vise (1).exe
"C:\Users\Admin\AppData\Local\Temp\Vise (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Vise (1).exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Vise (1).exe" MD5
    3⤵
    PID:5020
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1080
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1120

memory/5020-0-0x000001DB39870000-0x000001DB39A11000-memory.dmp

Download