523b2c1dcf112139e000e0bf0e5cb1564d1237ab88afc170c19d77f38b25f56f

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 02:25

Target
2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe
Size 2.4MB
Sample260729-cwpcfat1gs
SHA256 523b2c1dcf112139e000e0bf0e5cb1564d1237ab88afc170c19d77f38b25f56f
MD5 de008a82d3698b4e5c37c8a2c5ccbee0
SHA1 c197db6153bfbe5619048fd957a2768dea209226
SHA512 d0cb376b374a1dce2ed9534751d17a327531627166ea5fcafd879911dde8ddb843360c841d1fa9ba793cb99100c10aac9bc8c5784122b9b9ac61885fe42ba227
SSDEEP 49152:VDxJVDL8THgLFx5jWC7kYnj+THvPyArOSE0Sr1UeXQ8/l:TJO7kX5jWcOVaSMyeXLl
TLSH
T17BC59D87F59361FCD26BC07483569973F636B8484120BEBB56D4CB303E62EA05B1CB69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3508 set thread context of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89
PID 3508 wrote to memory of 1500	3508	2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_de008a82d3698b4e5c37c8a2c5ccbee0_akira_quasar-rat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:1500

memory/1500-0-0x00007FF68FC70000-0x00007FF68FD46000-memory.dmp

Download

memory/3508-2-0x00007FF662E40000-0x00007FF6630BA000-memory.dmp

Download