78f0cb66ab6e844ec438a5620c5c9cd64cb3e8ec9b3dd6b80ab56960845863f1

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:54

Target
vtun-windows-amd64.exe
Size 17.3MB
Sample261027-egalvaat4y
SHA256 78f0cb66ab6e844ec438a5620c5c9cd64cb3e8ec9b3dd6b80ab56960845863f1
MD5 9ee9b4a00c287caeaa9abe3ed05e8b44
SHA1 f8ab5e4d0db83bea210456607c6400f8e5320c27
SHA512 90bcb2da723b8ce59270362d957489bb948a085557c0e066adae0ead7af07fa9262251e37c5bc0e477b2b0ede5a25b03b8ef1ca11c6315d9acaf68d9591868b5
SSDEEP 98304:kgAg6hqWjhmFXlrq62IPYatZgfVc2hv80n3vzmyVTzJRxBlPx1duvzX4F2BwBZkR:kgZGUFXE62IQaXg990mDuvkcrifneM7
TLSH
T18E075B47F8A105E8C1ADD274C662A223BB717C445B3127D76F60F6642F32BD0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 5904	848	vtun-windows-amd64.exe	91
PID 848 wrote to memory of 480	848	vtun-windows-amd64.exe	92

C:\Users\Admin\AppData\Local\Temp\vtun-windows-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\vtun-windows-amd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\system32\route.exe
  route print 0.0.0.0
  2⤵
  PID:5904
- C:\Windows\system32\route.exe
  route print -6 ::/0
  2⤵
  PID:480