5244f77d17176b64ba571c1fdcd7c8e7a1e2f592c915294d1b936e9c75bb9070

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:12

Target
vapor-tray-windows-amd64.exe
Size 2.9MB
Sample260723-pdmr4swthw
SHA256 5244f77d17176b64ba571c1fdcd7c8e7a1e2f592c915294d1b936e9c75bb9070
MD5 dd3e4b3b4df28cea3b6e105378093c1d
SHA1 ef70d58a4245f8641b1b2025dc3d7e487675b6c0
SHA512 eea3aa1dfdb90bd9520a1726fc910467272e2ca463dbe283721470355746e50b3e050d6ce3deb934fc084e6ba0698cf2af936ab42381824ba46b7bd25adc85fa
SSDEEP 49152:75jPhAQET8NWYSdZDuNn1Pp32P9jhMgJgHn:75VZ2iyyazgH
TLSH
T19DE53A17FCA018F5C0AAA2718A7299527B31BC481F2167DB2B51B6783FB77D06C78724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 4 IoCs

Suspicious use of SendNotifyMessage 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2688	1696	vapor-tray-windows-amd64.exe	89

C:\Users\Admin\AppData\Local\Temp\vapor-tray-windows-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\vapor-tray-windows-amd64.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\vapord.exe
  C:\Users\Admin\AppData\Local\Temp\vapord.exe -addr 127.0.0.1:49835 -db C:\Users\Admin\AppData\Local\Vapor\library.db -plugins C:\Users\Admin\AppData\Local\Vapor\plugins
  2⤵
  PID:2688