304635dbc025b5c3bff78df48c19980e9b52c632a7d3c145b61288f546293bf7

Analysis

max time kernel
57s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 02:39

Target
Matcha External/System.ComponentModel.Primitives.dll
Size 78KB
Sample260627-c5ppkahs2k
SHA256 304635dbc025b5c3bff78df48c19980e9b52c632a7d3c145b61288f546293bf7
MD5 bc478fc2764a94c56e69e9e38a51452a
SHA1 1c199bf6064992a5a81472b091a01f45b4442889
SHA512 ae81a6ce5e66cdde1b074474459db6081c627b8b38e0f959ebcdee02ae935bb022e66f39a4451989aa59e3ebb15ce3052cc23ddee4c9db5e6649d33eaee484b6
SSDEEP 1536:MI5/UZMu4Thd+Cv8A/oqevD2olsmIbktDinxze:Mr4X+S85qKD2ommIiOK
TLSH
T1DE734B1823EC0216FBBD46BC9573A821D575F6821713D9CF4AA0D90E1F9BBC2E27152E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2800	sihost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Matcha External\System.ComponentModel.Primitives.dll",#1
1⤵
PID:1876

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:2800
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:3372

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2960

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4080

memory/2960-1-0x0000020355E40000-0x0000020355F40000-memory.dmp

Download