Analysis
- max time kernel
150s - max time network
132s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/05/2026, 15:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Azyra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Azyra.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target Azyra.exe
- Size 34KB
- Sample260516-tb1cmsfv3x
- SHA256 51d81167af3dcbd91b9027bfdd124c4cc496d959065fea01806729c8beff5caf
- MD5 b4ecc535a72720a3d2ea6eb706754f4c
- SHA1 c20b8a262919809b79d9f113be42f772727995e8
- SHA512 48d98b1d5fe10e83c36220310018ce96cbff2cbc98810945a4dead0d1d510fa8570ada4631a1ff14d03ea1e335740caa5892aff4adb12576e6f036357f75d128
- SSDEEP 768:vnGNbYiBucNbf0XMCIj/fL8wixhpRkZHUf:vnGxFfijI7Qxf
- TLSH T19CF228A74A2400FCD463D2F9D9A75D43D376B80A1371AADF57E080662FBB2C99837D12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe 1804 Azyra.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1804 wrote to memory of 5160 1804 Azyra.exe 80 PID 5160 wrote to memory of 1332 5160 cmd.exe 81 PID 1804 wrote to memory of 5384 1804 Azyra.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Azyra.exe"C:\Users\Admin\AppData\Local\Temp\Azyra.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode con cols=110 lines=322⤵
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\system32\mode.commode con cols=110 lines=323⤵PID:1332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:5384
-