9825aac5fa76ed9eb7fb7182418514934370139c38b6529cf910a8e8a56841a9

Analysis

max time kernel
299s
max time network
317s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VRChatMods.exe
Size 171.9MB
Sample260808-rhb8aastgy
SHA256 9825aac5fa76ed9eb7fb7182418514934370139c38b6529cf910a8e8a56841a9
MD5 9bc57a5dea6a19796c553cae2a1d8964
SHA1 96e117a96037cfee5c77b8bae52c93a77316439a
SHA512 3edeed8764f5b6401428e0fb926d808103da3e4cdbcc041ac0d9e1ae318cbd01688a79a088254a704dab40612a46c0051a615eff5fc62cf8bdf72cbc1937ad4b
SSDEEP 1572864:dasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:F4fc/M+i6xCL
TLSH
T138888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5588	javaw.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 5116	2288	VRChatMods.exe	79
PID 2288 wrote to memory of 5116	2288	VRChatMods.exe	79
PID 2288 wrote to memory of 5588	2288	VRChatMods.exe	80

C:\Users\Admin\AppData\Local\Temp\VRChatMods.exe
"C:\Users\Admin\AppData\Local\Temp\VRChatMods.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\VRChatMods.exe
  "C:\Users\Admin\AppData\Local\Temp\VRChatMods.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\VRChatMods" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1692,i,14880780285466573757,8488343365927079206,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2
  2⤵
  PID:5116
- C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Djava.awt.headless=false --add-opens java.base/java.lang=ALL-UNNAMED -cp C:\Users\Admin\AppData\Local\Temp\resources\java\75f792e4880d.jar V ira-91a1eb60::default
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jna9073646007744491898.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna9073646007744491898.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download