Analysis
- user interaction
yes - max time kernel
81s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 06:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
imgui_player_inspector.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
imgui_player_inspector.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target imgui_player_inspector.dll
- Size 1.4MB
- Sample260710-g1pk8aev7n
- SHA256 a7ee4c096df38da57e28bc280f7b043acbe74c538543328d7f43841fc2387d85
- MD5 87739b7d75dcee53fcf5f1cb4b474bb2
- SHA1 76ebca43e1ac5485cf3ab9082ccdd8446552865d
- SHA512 1b962d4b769517a70bcb329f09eff78eaae34e05ed4ebe89baaa8c3e7baa5a8d22d7f5ed3714cd84c92a1c67a68500756f8a1161bcef6b52597a0620745445bc
- SSDEEP 24576:vVx/+CxAMaObBBNmE+TBC0hMort8GbnhPiWnHo:vmMaCclC0IWnI
- TLSH T1B965B546E2F711E4E7BAD639B162322BF83274558B3897DB9BD4070A17A17E0D4BE700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5756 taskmgr.exe Token: SeSystemProfilePrivilege 5756 taskmgr.exe Token: SeCreateGlobalPrivilege 5756 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe 5756 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5756 taskmgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\imgui_player_inspector.dll,#11⤵PID:768
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5756