86f16faa4e899178169d06c99392e4b883bc1d77bd7f69f1a0713d78447d43bc

Analysis

user interaction
yes
max time kernel
71s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 23:55

Target
Axvion.exe
Size 168.6MB
Sample260822-3yetwsvzcs
SHA256 86f16faa4e899178169d06c99392e4b883bc1d77bd7f69f1a0713d78447d43bc
MD5 4f2bd5cd1c78fd6835179a9fce3b91d5
SHA1 3de90c81bee51b0ae375337305fa72d189609da4
SHA512 603f805469e09c829ac03651e95f2dae6e76c33980f2adca76a89dcea9b43399f70622a578c5a9acc30291716e41d04d3bdae432c2b0b291e8a05178dd85822c
SSDEEP 1572864:kOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:WgmeNxNNZxqV
TLSH
T166887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 4544	6012	Axvion.exe	86
PID 6012 wrote to memory of 468	6012	Axvion.exe	87

C:\Users\Admin\AppData\Local\Temp\Axvion.exe
"C:\Users\Admin\AppData\Local\Temp\Axvion.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Users\Admin\AppData\Local\Temp\Axvion.exe
  "C:\Users\Admin\AppData\Local\Temp\Axvion.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\axvion" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1708 --field-trial-handle=1712,i,5779383281034127544,17303006799251486147,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:4544
- C:\Users\Admin\AppData\Local\Temp\Axvion.exe
  "C:\Users\Admin\AppData\Local\Temp\Axvion.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\axvion" --mojo-platform-channel-handle=1760 --field-trial-handle=1712,i,5779383281034127544,17303006799251486147,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  PID:468