a48aaa833c7829a6d103cd60022421a0593182392d53fe11ef1431fe9380b892

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/mutex_holder.ps1
Size 1KB
Sample260506-e857tsav2y
SHA256 a48aaa833c7829a6d103cd60022421a0593182392d53fe11ef1431fe9380b892
MD5 29263509d122a32fe60e2ac8e0654136
SHA1 fcb88a174e467146492f9226d26ed066869e324f
SHA512 35b1f517d7e493e6b30b340ac8787a81431f5d070943b2bdb5a56a88d530271e26858c98f34fc377b902ee566312a10cbc8cdbb6fe0f3e39d2c28dc50310e4af
TLSH
T17D21EF22FFC65AA01C5360214B6A35427A6A5A33129ED8A03DDFD31CEF0221954548DF
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4596	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	powershell.exe
4596	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4672	4596	powershell.exe	85
PID 4672 wrote to memory of 5024	4672	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\resources\mutex_holder.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o220m2p4\o220m2p4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D09.tmp" "c:\Users\Admin\AppData\Local\Temp\o220m2p4\CSC1B45534DF7C446588CFF45B2C6FEB7BF.TMP"
    3⤵
    PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1D09.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1D09.tmp
Size 1KB
SHA256 17ff913b44aff81998a183cf3ba9c2dd30c0a6d1847ae36bbfb3e59b4060020d
MD5 556b7b3eee22d09f2ba2c8169901ed6b
SHA1 d6ead0c2c5b8640dd326ff3ee41f5316328c8087
SHA512 5cb02d6221de312663693ee46225e2f4ba3e2b671a715196dd646c00711260c006679ff5db90e15f5ef0dc387f4ff1f1f0812a7e81a9641f4bc5ae670ca15f24
TLSH
T13121C00993EC471EF0779731A9F9071FA278FD54EFA2535A8580426C2C51204FEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lwimmkzy.dv5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwimmkzy.dv5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

o220m2p4.dll

Path C:\Users\Admin\AppData\Local\Temp\o220m2p4\o220m2p4.dll
Size 3KB
SHA256 06d004ad348fb0829016b47745162cde961c5a39fe857a86a9a1a0995d9c19bf
MD5 0aebdb174a4e03fb566deb3c0f1369e5
SHA1 d8f6d356f6dcf712d022e3ee476547dddaa48ce2
SHA512 02259cb5a8d914448101025c37ef262c5bb4586ddd97a98332be40eb4bd62d022f0ef92d8bffac0424c27bb09f1291e7c1ebf1ee3c98ddf3a102aa7063799ece
TLSH
T14671000AB7E8022BE07E4B346AF6431362B6FC909F77D76E588412586C602A46D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1B45534DF7C446588CFF45B2C6FEB7BF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\o220m2p4\CSC1B45534DF7C446588CFF45B2C6FEB7BF.TMP
Size 652B
SHA256 665f745605b33d7aedd21bc0e6542247bfc456768d3ed1b9eccbcade72617247
MD5 c0aeb0d6a18b71d5a810c3616ad9f2dc
SHA1 3ce4a23e3b7279a3a89f03e3f56bd1d45ff338ce
SHA512 b311b208f2fef9df2c3d6344380aebb68ff20f3a282ef6ad633491158e4291f5321320388731b05a879632b5c2744521a2a01cc17415294816519aa13ef82a89
TLSH
T19AF0540D73F8020EF0F78B30BDF543A391A8BC65DE7253ED188403591864510A561FB2
MD5 SHA1 SHA512 TLSH

Submit Download

o220m2p4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\o220m2p4\o220m2p4.0.cs
Size 930B
SHA256 67c934fdf4be67b02037eb506ddaa2634df2bcd8d9974eeade0eb9a0bb85e79d
MD5 7ab96b97f587787e721ed29811785b91
SHA1 01d178c0256606d2e08432b7595c43185e618980
SHA512 26836c434dc221680316fc6f34d8ec8a31c99e25633cfdb3b0562376e1c1eba6e47931996ebd9ca575568205ebce949d3c0a7e9ad0a5c99d1dddf4da89518fd9
TLSH
T1B111BD21BEC14AB11C5320214B2A7542B566AA33269ED8A03DDFD3189F0150858588EB
MD5 SHA1 SHA512 TLSH

Submit Download

o220m2p4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\o220m2p4\o220m2p4.cmdline
Size 369B
SHA256 6740694e60cc24aade8537e0566b8883a5493ce66eb59580e848db28f2974a1c
MD5 94a4b2492d6167f0dfaeedf0a3692c52
SHA1 c947f080fac6151d9c2f96898380ae9ec05a5dde
SHA512 3bec9831e44c839965cf591b382a6a1cf48fc15a64a0ab966028da18a0ac7f1c1639a9c12f81ca37ab0824b14158c035205ae24984c7f8efae732a89c757a23d
TLSH
T1C4E0682A8746C3BF41FA200F616AC6ACD27306C33940BF8C60C0580DD05780D27E174B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4596-7-0x0000020F337A0000-0x0000020F337C2000-memory.dmp

Download

memory/4596-1-0x0000020F33790000-0x0000020F337A0000-memory.dmp

Download

memory/4596-0-0x0000020F33790000-0x0000020F337A0000-memory.dmp

Download

memory/4596-24-0x0000020F337D0000-0x0000020F337D8000-memory.dmp

Download

memory/4596-25-0x0000020F33790000-0x0000020F337A0000-memory.dmp

Download

memory/4596-26-0x0000020F31CE0000-0x0000020F31CEC000-memory.dmp

Download

memory/4596-27-0x0000020F33790000-0x0000020F337A0000-memory.dmp

Download

memory/4672-22-0x00000244B5650000-0x00000244B565C000-memory.dmp

Download

memory/5024-19-0x00000230BBFB0000-0x00000230BBFBC000-memory.dmp

Download