Overview

overview

7

Static

static

3

43310ecb56...96.exe

windows10-2004-x64

7

43310ecb56...96.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/06/2026, 19:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    43310ecb563fbcd8d13f1252240796efa6fabbe603b7ce6dad3058a67f224b96.exe
  • Size 15.1MB
  • Sample260601-x2eqeafs7p
  • SHA256 43310ecb563fbcd8d13f1252240796efa6fabbe603b7ce6dad3058a67f224b96
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Loads dropped DLL 25 IoCs
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43310ecb563fbcd8d13f1252240796efa6fabbe603b7ce6dad3058a67f224b96.exe
    "C:\Users\Admin\AppData\Local\Temp\43310ecb563fbcd8d13f1252240796efa6fabbe603b7ce6dad3058a67f224b96.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im gsMultimedia.exe -f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im gsMultimedia.exe -f
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2484

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CPKernel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\CPKernel.dll
        • Size 3.2MB
        • SHA256 eb34eb98d14bd6c9fc53067f63d485d518bf55d1af59607e4ab194b62877fa7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CPReader_English.ini
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\CPReader_English.ini
        • Size 17KB
        • SHA256 2b6654d2b1f12aafb637fb12eef5f58a6c7efce5436963d9878948ed498ad59a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GImageView.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\GImageView.dll
        • Size 543KB
        • SHA256 c85ca44b1ff1ad0af0ca3daf5f2302498846f3fdc2f48c6c7262f08280c6f5fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ImageZoom.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\ImageZoom.dll
        • Size 276KB
        • SHA256 72a81d79b8b670f2650c546369b5961579607ccbbbb7da0af4878109051bf428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Player.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\Player.dll
        • Size 80KB
        • SHA256 449c2fb932af519e0a7bdc6a26dccd1ecde9c290c3f2afd96ee8ff13ca6c4102
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\SDL2.dll
        • Size 1.2MB
        • SHA256 5ff3186465a347ce8a13991fdb659f77ee21ae5dc9813b9fb2aadafda8a86491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SharpWnd.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\SharpWnd.dll
        • Size 281KB
        • SHA256 2ad9292c875cb8b71a437b0da803d07867d2ed8deae4568f2be1f623755d5b60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        avcodec-55.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\avcodec-55.dll
        • Size 9.3MB
        • SHA256 2be959285f432eec4115a9d3d945b9594b5356b4d8d5774ae4b3de82bcec33e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        avfilter-4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\avfilter-4.dll
        • Size 1.5MB
        • SHA256 bfc20232c4ecf4aece403d005624c82a64a2d54d5d84720341dc6d45b3522ba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        avformat-55.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\avformat-55.dll
        • Size 1.2MB
        • SHA256 29ef7a1689a904d4d2d7d5bcb9f255eb15118901ddd67c7c8128b68f05d5fa92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        avutil-52.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\avutil-52.dll
        • Size 327KB
        • SHA256 67a0f7d47ceff1407b9c4851032346a9b81a75fee6569274f15d092610f04cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        corem.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\corem.dll
        • Size 52KB
        • SHA256 deac6221d0abe480012e836e5e9dd915828ae55401f0c46fb7ce8049c380c698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        corez.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\corez.dll
        • Size 92KB
        • SHA256 00d4986dfff92cfdd45576da9100d49f374a8dba1a476cfc8dc7cf50f5a6735f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        postproc-52.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\postproc-52.dll
        • Size 185KB
        • SHA256 72180a408b13b7d98c0bc2395b886a5c3aa0b2dea39ef081e193f60ef373365f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pthreadGC2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\pthreadGC2.dll
        • Size 68KB
        • SHA256 72e6c8dd77fa7e10a7b05ef6c3e21d3f7e4147301b0bf6e416b2d33d4e19a9c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pthreadVC2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\pthreadVC2.dll
        • Size 44KB
        • SHA256 ee15e6e3f82c48461eb638c1ea11019ae9e3e303e067e879115c6272139026e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        swresample-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\swresample-0.dll
        • Size 101KB
        • SHA256 d179c01c646d821cf745ae5e66ffc7ed394a61a595ecc2bccf27dc144ba91a2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        swscale-2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260601202049545\swscale-2.dll
        • Size 490KB
        • SHA256 4f17b1ceea162390f64f54a3d13de4bb9e553da1e51ae7061545b7843ddad9ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\gs_5139.tmp\7z.dll
        • Size 709KB
        • SHA256 6c80e3f49fcf561e6a0b52f9b4c81d1d07b22085f7864ee4cfd30dd10f6b3b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gsMultimedia.exe
        • Path C:\Users\Admin\AppData\Local\Temp\gs_5139.tmp\gsMultimedia.exe
        • Size 209KB
        • SHA256 c9a02bf16d0222e6534dc8f5ed6af8efc9ed53c5834be79fcc741500a192e624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2152-211-0x0000000006940000-0x0000000006950000-memory.dmp
        Download

        memory/2152-207-0x0000000006930000-0x000000000693B000-memory.dmp
        Download

        memory/2152-0-0x00000000018F0000-0x00000000018F1000-memory.dmp
        Download

        memory/2152-218-0x0000000006B60000-0x0000000006B7A000-memory.dmp
        Download

        memory/2152-213-0x0000000006950000-0x0000000006969000-memory.dmp
        Download

        memory/2152-232-0x0000000000400000-0x0000000001322000-memory.dmp
        Download