d1fa43f2f38124c80e8bf5035a433390b87a8cc4328e527d3bbb4f79586be409

Analysis

max time kernel
149s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 08:19

Target
langchian-0.2.5/langchian/splitter.py
Size 7KB
Sample260421-j734ases91
SHA256 d1fa43f2f38124c80e8bf5035a433390b87a8cc4328e527d3bbb4f79586be409
MD5 0c870df59114f774be6bdeb23ea59c13
SHA1 5ae6abaa3c94dd7f6ebc2ef8b5b2ed3d69b8173a
SHA512 6b8b1ee9eb4369ee5985de26d7d8b89c4c980704c2ec25e5f98de3832ca1b192cfb2069f1cb6707063971c7f3d47ec6a3b6fe2729028e246ed4594dac2cb9928
SSDEEP 192:tiT8eMU8o3RKUXA/aEv82466HRsj4Zd3WEzEQJspZDOFk:tiTv8oBXC8p666j4T3L2OFk
TLSH
T1C2F17565EC4784348A778C0DAD16E455E3727707AA31E02335AD81AC2FF4E2247ADB6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3908	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\langchian-0.2.5\langchian\splitter.py
1⤵
- Modifies registry class
PID:1480

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact