12f27975401cd9e423c13c78e202f0a3dc9c437988de838af935437d15631671

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 04:06

Target
Vise (1).exe
Size 1022KB
Sample260511-epbtwaa17y
SHA256 12f27975401cd9e423c13c78e202f0a3dc9c437988de838af935437d15631671
MD5 452dadbb19862e394a7bc18fa347441c
SHA1 58f52b7c789b950a5569f7719b4631f19846123b
SHA512 1a22425cdfeda2d3f752a9a91c6003709d259cd5ab788ea8ae366520cc58bafd01057ac7308dbf5969e0b855aeb7397beb2a32cc14e5f369e9c9e81b102528ae
SSDEEP 24576:BIYvI5yd9k4Y3z1GtxNST/XpZEpXlqBgtJ2PCZFl6b0UlQAMp:eGd9kVeSF41qBgtJ2PCZFl6b0UqAS
TLSH
T13825AF1A67A405E9C1B7D17CC6578617E7B270090371EBEF06E086A52F23BD16B3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1676	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3100	4484	Vise (1).exe	81
PID 3100 wrote to memory of 2100	3100	cmd.exe	82
PID 3100 wrote to memory of 4792	3100	cmd.exe	83
PID 3100 wrote to memory of 3392	3100	cmd.exe	84
PID 4484 wrote to memory of 3840	4484	Vise (1).exe	85
PID 3840 wrote to memory of 1488	3840	cmd.exe	86
PID 1488 wrote to memory of 1676	1488	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Vise (1).exe
"C:\Users\Admin\AppData\Local\Temp\Vise (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Vise (1).exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Vise (1).exe" MD5
    3⤵
    PID:2100
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4792
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1676

memory/1676-3-0x0000017A1D990000-0x0000017A1DA33000-memory.dmp

Download

memory/2100-0-0x000002CF5D830000-0x000002CF5DFDE000-memory.dmp

Download

memory/4484-1-0x00000208B6AA0000-0x00000208B6B43000-memory.dmp

Download