e776b7f83b6352458c4a98682b36b5c29550a527371b677c71737626cee44184

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 21:30

Target
e776b7f83b6352458c4a98682b36b5c29550a527371b677c71737626cee44184.exe
Size 191KB
Sample260828-1czwtstdmh
SHA256 e776b7f83b6352458c4a98682b36b5c29550a527371b677c71737626cee44184
MD5 e3703cdeccedead076891132965a91a4
SHA1 3c3c782577003fe2c618916b23f6ecbf72ab3968
SHA512 486c2adb03a17b80881822aad7a1775effb129dbeb780e5ed82e05e910adfda3eaa5e6795a7c3f27b938c9cacee7945a3b7d42a08373a123f6a8cb412688d7f2
SSDEEP 3072:jum2AODrZrFkbSItgx3VhLQSRwnl34sk+pbXMqqD2MqqD6Ip+Ci3VV7ifP6bYP2/:QAO3hFjIeVh7Rwnx4skibcqqD9qqD7pG
TLSH
T1E114DF0368A181F4D89180B48A4FADE65A32B9840B2051FF2BF1316C3FB56F69F77D21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5580	vu143atgni.sys

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4364	e776b7f83b6352458c4a98682b36b5c29550a527371b677c71737626cee44184.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 6132	4364	e776b7f83b6352458c4a98682b36b5c29550a527371b677c71737626cee44184.exe	88

C:\Users\Admin\AppData\Local\Temp\e776b7f83b6352458c4a98682b36b5c29550a527371b677c71737626cee44184.exe
"C:\Users\Admin\AppData\Local\Temp\e776b7f83b6352458c4a98682b36b5c29550a527371b677c71737626cee44184.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o "C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.pdb" "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/953A8DE880B0818C32DA2DEC1D79C2D91/ntkrnlmp.pdb"
  2⤵
  PID:6132

C:\Users\Admin\AppData\Local\Temp\vu143atgni.sys
C:\Users\Admin\AppData\Local\Temp\vu143atgni.sys
1⤵
- Executes dropped EXE
PID:5580

ntkrnlmp.pdb

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.pdb
Size 10.5MB
SHA256 e987244cfdc33cb195c34231d8905d9e87019b36f199d17ab0638187ce0aaf7f
MD5 566f8135567a80ba945eee5ce9be4f69
SHA1 26008b593f2deacd27d6c55220cbcacfeaeb1a37
SHA512 86bfd6689da02d75e8323b6420c35fc86c487906d82827ec595d6d308e9f32fb23aca9b2c72f071fab77ed78b3997b8fae5034bc105e1109f2e3df32c5603829
SSDEEP 49152:R85MWAL/kNIUlMy+1sA3w9QnZcaDkFAjcLU3I67bX3V/lxKPmng+Y99+1lM8faZJ:R85rADkNl63pnR7fDgf
TLSH
T150B60615BA937EF6DC5A457FA0160329F6F596CA03A947E33D46B3A90DC2212CF2E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vu143atgni.sys

Path C:\Users\Admin\AppData\Local\Temp\vu143atgni.sys
Size 78KB
SHA256 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1
MD5 b96d75a000367c200958089728fc5cb8
SHA1 f329ae0fdf1e198bea6ba787e59cb73f90714002
SHA512 60fb02287aff7b7d7b7057be6f0a828c702a0ba9653fd4079d0e5bea3b476dc06cae4f27292684c9235ed21a498403bbf4bc6609c0d9c3c2de920e981ef1df17
SSDEEP 1536:Qn8/+PtpHLPxNn1szNYeYVxRqx+g1JOE7ubt6INPXWmT6A5+KA:5/yTxNKOesx8xIh6AGLA5I
TLSH
T1C173E0D1162CA4C2ED879D31A2C8D623BC70B3911E62D6F391A5D1790E867C16F2C9AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download