12f27975401cd9e423c13c78e202f0a3dc9c437988de838af935437d15631671

Analysis

max time kernel
149s
max time network
47s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 03:53

Target
Vise (1).exe
Size 1022KB
Sample260511-efrhzaet5j
SHA256 12f27975401cd9e423c13c78e202f0a3dc9c437988de838af935437d15631671
MD5 452dadbb19862e394a7bc18fa347441c
SHA1 58f52b7c789b950a5569f7719b4631f19846123b
SHA512 1a22425cdfeda2d3f752a9a91c6003709d259cd5ab788ea8ae366520cc58bafd01057ac7308dbf5969e0b855aeb7397beb2a32cc14e5f369e9c9e81b102528ae
SSDEEP 24576:BIYvI5yd9k4Y3z1GtxNST/XpZEpXlqBgtJ2PCZFl6b0UlQAMp:eGd9kVeSF41qBgtJ2PCZFl6b0UqAS
TLSH
T13825AF1A67A405E9C1B7D17CC6578617E7B270090371EBEF06E086A52F23BD16B3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3656	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3296	4736	Vise (1).exe	80
PID 3296 wrote to memory of 3644	3296	cmd.exe	81
PID 3296 wrote to memory of 4888	3296	cmd.exe	82
PID 3296 wrote to memory of 2164	3296	cmd.exe	83
PID 4736 wrote to memory of 792	4736	Vise (1).exe	84
PID 792 wrote to memory of 1884	792	cmd.exe	85
PID 1884 wrote to memory of 3656	1884	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\Vise (1).exe
"C:\Users\Admin\AppData\Local\Temp\Vise (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Vise (1).exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Vise (1).exe" MD5
    3⤵
    PID:3644
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4888
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3656

memory/3644-0-0x00000174C0F30000-0x00000174C0F61000-memory.dmp

Download

memory/3656-3-0x000001E0F24A0000-0x000001E0F24D1000-memory.dmp

Download

memory/4736-1-0x000001CB98130000-0x000001CB98161000-memory.dmp

Download