Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 23:25
General
- Target VideoAIExt/Src/imgui/.github/workflows/build_windows_vulkan_libs.ps1
- Size 1KB
- Sample260822-3eepsagg55
- SHA256 49726d9d3bc9f663e33ce84761588253a55f4f156c3bb79fe681bf1427cc0bb5
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\VideoAIExt\Src\imgui\.github\workflows\build_windows_vulkan_libs.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Makefile
Makefile
__PSScriptPolicyTest_m4b2sqq4.ze4.ps1
memory/4832-21-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-6-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-7-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-8-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-9-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-10-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-11-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-12-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-13-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-14-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-15-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-16-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-17-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-18-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-20-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-0-0x00007FFFAF95F000-0x00007FFFAF960000-memory.dmp
memory/4832-23-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-22-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-4-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-29-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-28-0x00000277DCB30000-0x00000277DCBE2000-memory.dmp
memory/4832-30-0x00000277DCBF0000-0x00000277DCBFA000-memory.dmp
memory/4832-31-0x00000277DCBF0000-0x00000277DCC02000-memory.dmp
memory/4832-32-0x00000277DCB10000-0x00000277DCB1A000-memory.dmp
memory/4832-308-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-5-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-3-0x00000277DC650000-0x00000277DC672000-memory.dmp
memory/4832-864-0x00000277DCC30000-0x00000277DCC4E000-memory.dmp
memory/4832-27-0x00000277DCB10000-0x00000277DCB2E000-memory.dmp
memory/4832-865-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
memory/4832-866-0x00000277DCC10000-0x00000277DCC1A000-memory.dmp
memory/4832-867-0x00000277DCC70000-0x00000277DCC8C000-memory.dmp
memory/4832-868-0x00000277DCC20000-0x00000277DCC28000-memory.dmp
memory/4832-869-0x00000277DCC50000-0x00000277DCC56000-memory.dmp
memory/4832-870-0x00000277DCC60000-0x00000277DCC6A000-memory.dmp
memory/4832-872-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp