b5b6995b191a285551a00baab290e7f612da27af74f29864c01cd88b5098505e

Analysis

user interaction
yes
max time kernel
80s
max time network
81s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 14:58

Target
Ventrox.exe
Size 130KB
Sample260816-schcsaeb23
SHA256 b5b6995b191a285551a00baab290e7f612da27af74f29864c01cd88b5098505e
MD5 9cd3f7e33d2b30dd5e5e559580dae2e7
SHA1 39d79da6fbe9ee2143ff25a2ee103c58faa64d25
SHA512 fae0b97156a87d2a22d9ae9bc8b0ecd5d1c2eef67df775955bf189437891915d27cfc460160c32704822afa66e46ca16c82b9ccdd62be0a20c414967b1248aed
SSDEEP 3072:qj+HE6Cdn1zZwj8Hw7ompdw78TGcjQESBS7G6pM9sMf:qj+HpCdn1zZwj8HwEmjw7XcjBSBSKViE
TLSH
T1BED33C16B69901BDD276D6F8D9830902DB73BC860735A7CF039199920F27AD89F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5604	Ventrox.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 5996	4956	Ventrox.exe	89
PID 4956 wrote to memory of 5604	4956	Ventrox.exe	91

C:\Users\Admin\AppData\Local\Temp\Ventrox.exe
"C:\Users\Admin\AppData\Local\Temp\Ventrox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\system32\tar.exe
  tar.exe -xf "C:\Users\Admin\AppData\Local\Temp\app\Ventrox.zip" -C "C:\Users\Admin\AppData\Local\Temp\app"
  2⤵
  PID:5996
- C:\Users\Admin\AppData\Local\Temp\app\Ventrox.exe
  "C:\Users\Admin\AppData\Local\Temp\app\Ventrox.exe"
  2⤵
  - Executes dropped EXE
  PID:5604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:616

Ventrox.exe

Path C:\Users\Admin\AppData\Local\Temp\app\Ventrox.exe
Size 1.8MB
SHA256 42faad0788fd61c238b095fd3181dd9f1d048ce80e06f62b3bdb482b159baa8f
MD5 97b58ba149a8efca00e2567b296bb90e
SHA1 3e1047082f09af15368bf5be4b8ea45e823a22f1
SHA512 e7e2195ae7afd588eebdeeeb725495f64b111f2a3829d7a8afd3d47517f5897ddf9c1c648694fa9c14cf9b3648051b3ba22b9055c8ab4bdcd128ec38578c5661
SSDEEP 24576:9hOkEGt4oac5+CZ5lzVcMZuf3EtT5+uuotRWVZyuBhVkgLk8kyLh:9tEGv75Znb6EtdzqyWg
TLSH
T1F5858E1BE6A800ACD1A7C1B9CA175A07E7B174490730AFDF07904AA62F13FE55B7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ventrox.zip

Path C:\Users\Admin\AppData\Local\Temp\app\Ventrox.zip
Size 902KB
SHA256 d81b93c3a086c8942c660199a79a947a99bfa9674d3746d2c1f7557cf5e7bbaf
MD5 38632438b34fb6e13a8c1c77503fb008
SHA1 65f6291acffddd9c9578f7bc452f40a905f8b5d7
SHA512 34b653ff4e032c56ceaf9114243f1fc3c27116eeb279567421fccde1bc02285d92159f6cbf3a4183b8d0bcbd7b70355badd0bab129c5421dbece81b490028e4e
SSDEEP 12288:0yFAGFa4AxzsklqPGqz6tXRRUKL61+03vasGwgugRPfZNjuiJOtxzjeghgew6yLH:H9aqk7q+DNO+eWxP+isPjeneSAE
TLSH
T1A31533580888A3D260EC421E77A68BC864950E3DC5EBBE9D14F9DC98DC5F61E352F4EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Temp\app\data\config.json
Size 676B
SHA256 8f5ce6a806a4433152cf0dc185bc377da8779968b867cf01f90e4876ad42c961
MD5 be9d0409d11562ef5a6f9b139d861f42
SHA1 861704f24b21cc84949261a324073bd0af360cbb
SHA512 ef3342148c26b53f994e26a3405f24f92b4f0af9c7e057dedcdd4c162649ccd3be514a6fd9d20caa8cec33cb724d4a38cf9268a4c08a74a068c71a13fbac563f
TLSH
T1D2014415076016BA69B960052178BA131A786F5224771E2FFFB3156D138BE13F48DF88
MD5 SHA1 SHA512 TLSH

Submit Download

version.txt

Path C:\Users\Admin\AppData\Local\Temp\app\version.txt
Size 7B
SHA256 8456accd9a842531ca2aa6832c731ed07597335b35bbdb470044c5365e8fdc82
MD5 72c26e6cc0eb0a98a8ff70859e0f2c40
SHA1 f3e17516d027efea97160c72762a75deb703ac77
SHA512 d3b484de399c5d3bc26d98dbe133d867862fca816bc94a99f1727c2990369c2961a04753c9cbca5600c466ff0a72b352c824e9a29a3db16ee319bd75e4fdd7a7
MD5 SHA1 SHA512

Submit Download