Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 06:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1255d496a426d136564a136399bd5af841c8fd13b47e16ab247c818d64189b59.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1255d496a426d136564a136399bd5af841c8fd13b47e16ab247c818d64189b59.exe
Resource
win11ltsc2024-20260629-en
2 signatures
150 seconds
General
- Target 1255d496a426d136564a136399bd5af841c8fd13b47e16ab247c818d64189b59.exe
- Size 12KB
- Sample260706-gr4c1saw4x
- SHA256 1255d496a426d136564a136399bd5af841c8fd13b47e16ab247c818d64189b59
- MD5 0f774e264585516e95fd3189e9c8163a
- SHA1 d55ad9f43f5579b52289d3cf9adf5018844c0cc4
- SHA512 0e5d045319f2878a1b6f7b79246dbb5b806b34f119711940011afbad980e81ecec6a141502346fa76019b5eabe8056c54302e0f6f15c107544745e424f392e15
- SSDEEP 192:KXuV/WrejY4mQhSuIjp7eb+FLHLwSdYI85G1XJ7Fp/RJ8J3Vw6:KwjMlTuIjpHHLwSd85GDPoJlw
- TLSH T19E422AC2B1D2D1F8C19BC379A56B12B3A277344123367BBF774D84504F927309AA8A9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1216 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6160 wrote to memory of 1216 6160 1255d496a426d136564a136399bd5af841c8fd13b47e16ab247c818d64189b59.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\1255d496a426d136564a136399bd5af841c8fd13b47e16ab247c818d64189b59.exe"C:\Users\Admin\AppData\Local\Temp\1255d496a426d136564a136399bd5af841c8fd13b47e16ab247c818d64189b59.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6160 -
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\ProgramData\NyxoraSys\yhd-yoke.dll",UpdateHandler2⤵
- Loads dropped DLL
PID:1216
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NyxoraSys\yhd-yoke.dll
- Size 410KB
- SHA256 2f482073be1762583031b4c6076d9096c7fcd3017b5a244670f696028553e5b6
- MD5 3c5d6ba7e3962e81e3af2424b1743105
- SHA1 978a91ac94ed2a6b1fdf7b14158648a6d7259cd5
- SHA512 060b6fe30718c0fb87e5487c60175910db253305e6269a21e817fad2efb76bbd0ba27cb5e00bf980036af7246977d2abb24b968d4359fc99a361e1e94072c377
- SSDEEP 6144:vMDpbT6LXhk8IxZXEGbwCpbVUp0JsyJTP9EbEjf4/VgYMoj6VD2xvcu:vMl6Dh+UIvtVUp0JsUT16Ej7XVKxku
- TLSH T1B1943849F116AEE0C8FBC33AA65611A3D6FCB84403305EFB9BDC57605DC02A0B5796E9
- MD5 SHA1 SHA512 SSDEEP TLSH