5d47873913d2eb0270ce87955e762b42fb22beec3c84cd2d49e568e58aec8515

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/06/2026, 12:18

Target
install.exe
Size 18KB
Sample260614-pgwt7acz7x
SHA256 5d47873913d2eb0270ce87955e762b42fb22beec3c84cd2d49e568e58aec8515
MD5 3b159e791568aec14100af3829091d1a
SHA1 a95c629d1a614c825ba2ea685b9dd76d969bd77e
SHA512 281550cd0a718c7b7a200604119b34eb781be5f16247d8e499d52caf65797dda9c5eb3bf9431b55c5756353e0d5f19a61bc0f02780819dccd1a097e9eee049f8
SSDEEP 384:zsjstgLxOzA0SvC9BOx68bgP4obDG3K87DWtCeyZp1:zVelk6jUoKRzyZp
TLSH
T138824F46E20B52F4C4EAC337974A661355FDBD112232663BAFEC9A711E42730A6183FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	1880	install.exe

Loads dropped DLL 1 IoCs

pid	Process
4276	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 4276	1880	install.exe	88

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe "C:\ProgramData\EpsonPrint\Cache\orc_mod.dll",ServiceCheck
  2⤵
  - Loads dropped DLL
  PID:4276

orc_mod.dll

Path C:\ProgramData\EpsonPrint\Cache\orc_mod.dll
Size 370KB
SHA256 23212c50375b93001b31214f6a3f4f3a1117baad3bb441c6f9130fd16e4bdc48
MD5 f186a4fd0ec838656c8333861325fe68
SHA1 e15fb6e447cd0f007a0c153f3bbc3b6eded0c20c
SHA512 4c7267cc609c450dc57c693a05ca4cf973ab96e1d574f78bcea8ba8d89016dee922e59ba3fcc529b981149d7aaa3550b49db3516bc8f4c334837a5eaafb64f8c
SSDEEP 6144:oFEpZXKuIwhs2UKlF/Z6e1rp44fAMBqUPn5+ELfm3lZs6bcDGA:oFEpZXKPgxJlFEP0n5lQlEDG
TLSH
T1EC840648F1439DE4C4FBC33692460263E6FD781813349EFB9BCCA6651D816A0B6786ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download