Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 22:11
General
- Target Wondershare PDFelement 11.4.26.3648.exe
- Size 195.6MB
- Sample260602-131wtafx4m
- SHA256 c876d18eb59ae05f5c09e66d59a60ff724ae9bc8942dbda605134b37399b3f6e
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wondershare PDFelement 11.4.26.3648.exe"C:\Users\Admin\AppData\Local\Temp\Wondershare PDFelement 11.4.26.3648.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5L14S.tmp\Wondershare PDFelement 11.4.26.3648.tmp"C:\Users\Admin\AppData\Local\Temp\is-5L14S.tmp\Wondershare PDFelement 11.4.26.3648.tmp" /SL5="$40256,204731164,67072,C:\Users\Admin\AppData\Local\Temp\Wondershare PDFelement 11.4.26.3648.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ISTask.dll
VclStylesInno.dll
Wondershare PDFelement 11.4.26.3648.tmp
memory/1088-5-0x0000000002390000-0x0000000002391000-memory.dmp
memory/1088-16-0x0000000007240000-0x0000000007256000-memory.dmp
memory/1088-22-0x0000000007470000-0x000000000778A000-memory.dmp
memory/1088-24-0x00000000078E0000-0x00000000078E1000-memory.dmp
memory/1088-25-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-26-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-32-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-31-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-30-0x0000000007900000-0x0000000007901000-memory.dmp
memory/1088-29-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-28-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-27-0x00000000078F0000-0x00000000078F1000-memory.dmp
memory/1088-52-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-53-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-83-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-86-0x000000000760E000-0x000000000760F000-memory.dmp
memory/1088-82-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-81-0x0000000007A10000-0x0000000007A11000-memory.dmp
memory/1088-80-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-79-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-78-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/1088-77-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-76-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-75-0x00000000079F0000-0x00000000079F1000-memory.dmp
memory/1088-74-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-73-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-72-0x00000000079E0000-0x00000000079E1000-memory.dmp
memory/1088-71-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-70-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-69-0x00000000079D0000-0x00000000079D1000-memory.dmp
memory/1088-68-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-67-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-63-0x00000000079B0000-0x00000000079B1000-memory.dmp
memory/1088-62-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-61-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-60-0x00000000079A0000-0x00000000079A1000-memory.dmp
memory/1088-59-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-57-0x0000000007990000-0x0000000007991000-memory.dmp
memory/1088-56-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-55-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-54-0x0000000007980000-0x0000000007981000-memory.dmp
memory/1088-50-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-49-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-48-0x0000000007960000-0x0000000007961000-memory.dmp
memory/1088-47-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-46-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-45-0x0000000007950000-0x0000000007951000-memory.dmp
memory/1088-43-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-42-0x0000000007940000-0x0000000007941000-memory.dmp
memory/1088-41-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-36-0x0000000007920000-0x0000000007921000-memory.dmp
memory/1088-65-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-66-0x00000000079C0000-0x00000000079C1000-memory.dmp
memory/1088-64-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-58-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-51-0x0000000007970000-0x0000000007971000-memory.dmp
memory/1088-44-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-40-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-39-0x0000000007930000-0x0000000007931000-memory.dmp
memory/1088-38-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-37-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-35-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-34-0x0000000007790000-0x00000000078D0000-memory.dmp
memory/1088-33-0x0000000007910000-0x0000000007911000-memory.dmp
memory/1088-87-0x0000000007470000-0x000000000778A000-memory.dmp
memory/1088-88-0x0000000007470000-0x000000000778A000-memory.dmp
memory/1088-89-0x0000000007470000-0x000000000778A000-memory.dmp
memory/1088-92-0x0000000007470000-0x000000000778A000-memory.dmp
memory/1088-93-0x0000000007470000-0x000000000778A000-memory.dmp
memory/1088-94-0x0000000007470000-0x000000000778A000-memory.dmp
memory/1088-95-0x0000000002390000-0x0000000002391000-memory.dmp
memory/1088-100-0x0000000007470000-0x000000000778A000-memory.dmp
memory/6012-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/6012-96-0x0000000000400000-0x0000000000417000-memory.dmp