dff723ba59d57d136764a04b9b2d03205544f7cd785a711442d6d2d085ac5073

Analysis

max time kernel
148s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 03:29

Target
fonts/NotoSansJP-Regular.otf
Size 4.3MB
Sample260708-d2dnkaaz5m
SHA256 dff723ba59d57d136764a04b9b2d03205544f7cd785a711442d6d2d085ac5073
MD5 f82ef23cfbf8b46a234465b0151ee71f
SHA1 2a167a116b54ecd4f939e47d0ad78cb3402d938c
SHA512 3c272ff15e1783c33bc3b9bd2b5c6088092195559017bf0c50b96df43f5f6935acd4def885480a4a1f96e1751c555197048ad5e78251a180997888b015a841a4
SSDEEP 98304:rIC+RZxpNAs/Irv7kTXpg2Yxo3eN9pD23h9S9KXUxN6iz93bgZB5vjGrinwFbE08:8CQvp/E7Ugrx6gpDsh9SQXw9Lg35vqbG
TLSH
T1E626025F71ADA824C614A0B13663F44A77AA546C494FE2F8E407AE337CE52303BED791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5876 wrote to memory of 4172	5876	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\fonts\NotoSansJP-Regular.otf
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\fonts\NotoSansJP-Regular.otf
  2⤵
  PID:4172

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact