Analysis
- max time kernel
900s - max time network
376s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 11:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Azyra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
Azyra.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
General
- Target Azyra.exe
- Size 34KB
- Sample260602-n3emcsdv3m
- SHA256 51d81167af3dcbd91b9027bfdd124c4cc496d959065fea01806729c8beff5caf
- MD5 b4ecc535a72720a3d2ea6eb706754f4c
- SHA1 c20b8a262919809b79d9f113be42f772727995e8
- SHA512 48d98b1d5fe10e83c36220310018ce96cbff2cbc98810945a4dead0d1d510fa8570ada4631a1ff14d03ea1e335740caa5892aff4adb12576e6f036357f75d128
- SSDEEP 768:vnGNbYiBucNbf0XMCIj/fL8wixhpRkZHUf:vnGxFfijI7Qxf
- TLSH T19CF228A74A2400FCD463D2F9D9A75D43D376B80A1371AADF57E080662FBB2C99837D12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe 4916 Azyra.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4916 wrote to memory of 3844 4916 Azyra.exe 82 PID 3844 wrote to memory of 1964 3844 cmd.exe 83 PID 4916 wrote to memory of 4388 4916 Azyra.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Azyra.exe"C:\Users\Admin\AppData\Local\Temp\Azyra.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode con cols=110 lines=322⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\system32\mode.commode con cols=110 lines=323⤵PID:1964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4388
-