149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 13:13

Target
BootstrapperNET/runtimes/app.asar.unpacked/node_modules/get-fonts/binding.dll
Size 125KB
Sample260608-qgercaex3s
SHA256 149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
MD5 eeb1d1ea9fc3f870f292161cfa79850d
SHA1 ea4f4324245f9f4d6280ef285151f688221d6023
SHA512 795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254
SSDEEP 3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG
TLSH
T1E4C35B1B73A440BBE4778179C8531A05E772B8610B71DBDF07A0429A1F637E1AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

pid	Process
1472	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BootstrapperNET\runtimes\app.asar.unpacked\node_modules\get-fonts\binding.dll,#1
1⤵
- System Time Discovery
PID:1472

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact