2f25bdb328e22f9cd0336839e9aded37b2ff225fe99fa6b0746c02fe59e799a1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 15:01

Target
2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe
Size 913KB
Sample260728-sdwlsszvb1
SHA256 2f25bdb328e22f9cd0336839e9aded37b2ff225fe99fa6b0746c02fe59e799a1
MD5 e681576fbfa0e8bebe934bbd0e102947
SHA1 6dc899c222969976cea0ea63a7293f7d99cc5189
SHA512 4b8fcb9d635e8de599bda25205859bd06eed802c3bde8abe6fa0fe17a1ea25f1e8785e43b4be58a5311d3c2302fe796d227651eb042e67e2b94e334d02172d6e
SSDEEP 24576:djB+SSqXrvrGUR6PY1JYhqRf9tDqO+9jlKxrRCK:ZBYqXQc9tDF+98R7
TLSH
T1BB159D87F5E751BCD26BC07483669A73FA31F84901107EBB56E4CB303D62E906B18B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86
PID 4528 wrote to memory of 3036	4528	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:3036

memory/3036-0-0x00007FF6D51C0000-0x00007FF6D520B000-memory.dmp

Download

memory/3036-4-0x00007FF6D51C0000-0x00007FF6D520B000-memory.dmp

Download

memory/3036-3-0x00007FF6D51C0000-0x00007FF6D520B000-memory.dmp

Download

memory/3036-5-0x00007FF6D51C0000-0x00007FF6D520B000-memory.dmp

Download

memory/4528-1-0x00007FF7CF5B0000-0x00007FF7CF69B000-memory.dmp

Download