712a64c88be355acde988c14773a553804db0388d68160db2154dab91b721c0c

Resubmissions

16/09/2026, 08:45

16/09/2026, 08:42

user interaction
yes
max time kernel
10s
max time network
9s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 08:45

Target
VFTcssn.exe
Size 4.9MB
Sample260916-knpx1axfph
SHA256 712a64c88be355acde988c14773a553804db0388d68160db2154dab91b721c0c
MD5 295c93e464866159e16b529f1d2c99bb
SHA1 ac7dac72c9a02bb2a84ae30320882951cb6bd2dd
SHA512 2413a8dc1f3936d46c096730870e047edb2fffe3eb800f46ee56e966a803e78bc669150b0a98f87611a4b4990d2d2f8e703cf32b3faf46ef0f147a68a8226b8b
SSDEEP 98304:OKyGQP2BPnheXlydHSvuMay5IGYaz6Y+HlI7eW:OaPnheXly09ayGGYAclk
TLSH
T15C367C03F26251E8C06AC5B4934AA133F6753C8D47247AEF5BD06B212E65FD06B3DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4440	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	VFTcssn.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4440	2420	VFTcssn.exe	88

C:\Users\Admin\AppData\Local\Temp\VFTcssn.exe
"C:\Users\Admin\AppData\Local\Temp\VFTcssn.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  - Deletes itself
  PID:4440

memory/4440-0-0x000002030BDF0000-0x000002030BDF1000-memory.dmp

Download