cc8826b9ed4a72299c4db48fae077f5a3e659bb03671b7c40cb094d8e727cde0

Analysis

user interaction
yes
max time kernel
44s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:50

Target
Ryujinx.exe
Size 70.0MB
Sample261027-p26vwstyfx
SHA256 cc8826b9ed4a72299c4db48fae077f5a3e659bb03671b7c40cb094d8e727cde0
MD5 98a17043b9b91d84e470568e2c6daa87
SHA1 240b5a6e408b123e8dd002cbd3871ad9c9d849c1
SHA512 7ef214e65eeb719ac997c548640f7fed13e3168c40effdeb54862a0f773c96ca8badd36a992de5946d73d79b3cc839adaa2882ffd634ae3751d84c70c802fa8f
SSDEEP 393216:MWwKLxxKbJrS/AkbjBjZITGSI8rPPRz7e7Oc8d4ye937wtG6:ByYFGzPNe7V8d5K37wtn
TLSH
T1F3F7AD05E7D88E2AD1BF8334903110119776F45B6362EB8F714CE2F82F677944E6A6E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	Ryujinx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4956	ShellHost.exe

C:\Users\Admin\AppData\Local\Temp\Ryujinx.exe
"C:\Users\Admin\AppData\Local\Temp\Ryujinx.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:52

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1032

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4756

memory/4076-1-0x0000023201BB0000-0x0000023201E4E000-memory.dmp

Download