9a174e6c4460f8ce62217123116e143acd888e8e26b9b0ff77a17a94d5bf02e4

Resubmissions

27/05/2026, 12:19

260527-phjagsdt4j3

27/05/2026, 12:13

260527-pdyvdaft2t3

Analysis

max time kernel
119s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/python3.9/multiprocessing/shared_memory.pyc
Size 14KB
Sample260527-pdyvdaft2t
SHA256 9a174e6c4460f8ce62217123116e143acd888e8e26b9b0ff77a17a94d5bf02e4
MD5 b8922e16ff0a36f26ef32368d9314157
SHA1 3452c9b26574326c252a865252241c880fe86c05
SHA512 2b91e9db99222b07407c6a58e8d44c28e0eff0545f05c6956ada7fb087cc87363db0875a45950b34b745dbaa86c18403aff86c4d0f270371812adfd116e74646
SSDEEP 192:rrnPM0Dwo78rHMh5J5Ff2AvVNc+QildhId+qKPizV+pk2hSF/Z:XnPxYrs7vZ2AvV7QIdhIdRFJ+22hSNZ
TLSH
T11F52D7D3BA68086BFCD5F2B9B5CB1345BB28C27A03165D837809D16F0F841943DBDA99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5220	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.9\multiprocessing\shared_memory.pyc
1⤵
- Modifies registry class
PID:3608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads