52b8c3add2e0be23614d1ce2472e0e110c7f9e9c76e697b6cf57f0dd956882da

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 19:39

Target
vesta.exe
Size 4.8MB
Sample261009-yc9d6adx21
SHA256 52b8c3add2e0be23614d1ce2472e0e110c7f9e9c76e697b6cf57f0dd956882da
MD5 33f07c8b8f50c100ab64505eab196735
SHA1 2d76f17ec96e1087cf5470d10390be047ccb7e07
SHA512 9c58acfa4d3916dda6d726324f23466c25fa6f7617ceef86524d61966f787fdce21a0b81beb25491917e0bf73d506c5eabe913bfabde610e51d964d2d67dea0d
SSDEEP 49152:55kTBgTSRmoYZutqDr7w10og+56Ge8ub5QsLV4+coc9MqT01yggMvihHluGnu6vO:5OiHfZ6RuNQsLIvhWZ6veo2Q
TLSH
T1EE36BF03A3A401ECD436C178CA6ADA03E7B6785547346EEB325C5A2B1F636E46E7F710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3428	4820	vesta.exe	89

C:\Users\Admin\AppData\Local\Temp\vesta.exe
"C:\Users\Admin\AppData\Local\Temp\vesta.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\vesta.exe
  "C:\Users\Admin\AppData\Local\Temp\vesta.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428

elevation.log

Path C:\Users\Admin\AppData\Local\Temp\vesta\elevation.log
Size 355B
SHA256 c8f2ffbaeb97596fdc80af471fd2a4fec11be5c1191ef98710fba77f10df5462
MD5 1091cd88795bd2bfd4b2398eefb116a6
SHA1 0715926176b1062eb7e311d9c9c1ca4a6661d409
SHA512 59168497a2e636f621a32360eaa71faed75c3ec60fc4649ee418a8a68b3fb5db88526291e09c42852195994a8fcab1160f97d464a6820ac33d47111087736d98
TLSH
T1C6E046165E49092AF34F23BF89C836C9639E312180D76B820E6A2835329161B08AF00E
MD5 SHA1 SHA512 TLSH

Submit Download