99dc1ea286648ec882d71ab5071e3072c702e5170770843177807179c63f4593

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 12:19

Target
zira-miszsn.exe
Size 3.7MB
Sample260713-pg53vsaz21
SHA256 99dc1ea286648ec882d71ab5071e3072c702e5170770843177807179c63f4593
MD5 80588ad7bcc4c92c0b9e005178cf8414
SHA1 8caf6a3d3175bb375650179e74ec405169f7fb27
SHA512 590398de2ad0071f1f790c85a20ac2dc847964d827e4df155a745b52294bbd2fbf8b491f8f2ba8ba75807fd74504fdd391348e1328a94225708fe7a805be12ef
SSDEEP 49152:K6K1K+gBUcOSrSCVb6KbS7RWxHzwiIH5NZSV4P0coLPdAptvDy1d+HzKbC6Hsq1q:huQzG0YQVA0/LPmry1dhLTjUCc
TLSH
T19B06011DE38D52E8D213D134CBA65232EBB4B85A0761B9EB165EC7192FB79D01F3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zira-miszsn.exe	zira-miszsn.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 2040	2224	zira-miszsn.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2040	2224	zira-miszsn.exe	88
PID 2224 wrote to memory of 2040	2224	zira-miszsn.exe	88
PID 2224 wrote to memory of 2040	2224	zira-miszsn.exe	88

C:\Users\Admin\AppData\Local\Temp\zira-miszsn.exe
"C:\Users\Admin\AppData\Local\Temp\zira-miszsn.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:2040

memory/2040-0-0x00007FF73F3E0000-0x00007FF73F6A6000-memory.dmp

Download

memory/2040-9-0x00000184E5440000-0x00000184E5441000-memory.dmp

Download