Overview

overview

7

Static

static

3

1fichier-dl.exe

windows10-2004-x64

7

1fichier-dl.exe

windows11-ltsc_2024-x64

7

1fichier-dl.pyc

windows10-2004-x64

3

1fichier-dl.pyc

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 19:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1fichier-dl.exe
  • Size 50.2MB
  • Sample260712-ynbl9sas3w
  • SHA256 bc35f0d60263b6bd6cb97692a44f14f0a48895151037162af4ee3a580e215989
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 56 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fichier-dl.exe
    "C:\Users\Admin\AppData\Local\Temp\1fichier-dl.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Users\Admin\AppData\Local\Temp\1fichier-dl.exe
      "C:\Users\Admin\AppData\Local\Temp\1fichier-dl.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:3480

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          expand_less_494d53_180.svg
          • Path C:\Users\Admin\.cache\qdarktheme\v2.1.0\expand_less_494d53_180.svg
          • Size 235B
          • SHA256 5e055ae3512c841ec513aebb5ba14a0a341c7da46f2b63650b330930207f89cf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\Qt5\bin\MSVCP140.dll
          • Size 576KB
          • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\Qt5\bin\MSVCP140_1.dll
          • Size 30KB
          • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\Qt5\bin\Qt5Core.dll
          • Size 5.7MB
          • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Gui.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\Qt5\bin\Qt5Gui.dll
          • Size 6.7MB
          • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Svg.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\Qt5\bin\Qt5Svg.dll
          • Size 322KB
          • SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Widgets.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\Qt5\bin\Qt5Widgets.dll
          • Size 5.2MB
          • SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
          • Size 43KB
          • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtCore.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\QtCore.pyd
          • Size 2.4MB
          • SHA256 203bb6236f23f57ad8cdab5bbf4537a4abbc0b0879cf2893a8dc930e679dd846
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtGui.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\QtGui.pyd
          • Size 2.4MB
          • SHA256 2ca28d29ec4f2f50b4ccc70c7d6399b314151bc38852833d2d30097773bb1c00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtSvg.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\QtSvg.pyd
          • Size 114KB
          • SHA256 b1e2eb37a22016b4a06b9aef0d1f0c7c762461a6bb2ac9b68002d6c59c1a49fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtWidgets.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\QtWidgets.pyd
          • Size 4.9MB
          • SHA256 e4a06fe65b02c568db984771fb9a46ea95a8e4353ea85c942f954cba02dec635
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sip.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PyQt5\sip.cp310-win_amd64.pyd
          • Size 119KB
          • SHA256 b7492bb574f1ea88a1eeef3ea4ea0dac21c427ff54294600cf0ea42bb5ca53fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\VCRUNTIME140.dll
          • Size 95KB
          • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\VCRUNTIME140_1.dll
          • Size 36KB
          • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_asyncio.pyd
          • Size 60KB
          • SHA256 2c9f565254e4b2744d52b58f4960d5da1330c7846059b772044e4415804d933e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _brotli.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_brotli.cp310-win_amd64.pyd
          • Size 861KB
          • SHA256 58bacb135729a70102356c2d110651f1735bf40a602858941e13bdeabfacab4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_bz2.pyd
          • Size 78KB
          • SHA256 31dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_cffi_backend.cp310-win_amd64.pyd
          • Size 177KB
          • SHA256 2093e7e4f5359b38f0819bdef8314fda332a1427f22e09afc416e1edd5910fe1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_ctypes.pyd
          • Size 117KB
          • SHA256 b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_decimal.pyd
          • Size 242KB
          • SHA256 4f1ecc777c30df39cd70600cd0c9dc411adb622af86287b612f78be2a23b352c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_elementtree.pyd
          • Size 122KB
          • SHA256 fecc11695287d3972ab854530fc83445eee323f82074e2bef7f86ab4949b6497
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_hashlib.pyd
          • Size 60KB
          • SHA256 9da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_lzma.pyd
          • Size 151KB
          • SHA256 75d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_multiprocessing.pyd
          • Size 30KB
          • SHA256 b2d81c59e7ba45ce85f557c67a02ebbb01433136b6dd5075afcf115f57b73115
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_overlapped.pyd
          • Size 45KB
          • SHA256 622171218fab2952c569acdbf0489d0098fa0664f61624d1c4f040410731be41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_queue.pyd
          • Size 27KB
          • SHA256 827a07b27121200ed9fb2e9efd13ccbf57ca7d32d9d9d1619f1c303fb4d607b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_socket.pyd
          • Size 74KB
          • SHA256 9558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_ssl.pyd
          • Size 153KB
          • SHA256 41278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_tkinter.pyd
          • Size 61KB
          • SHA256 3ddcdec7a7a9b01f1af5a57f3cd66ae68883416fa7fb6aa7fa51b9cf1c24bf07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\base_library.zip
          • Size 859KB
          • SHA256 6a3302d1429923148f36d6b091af6b6db0a6b856b5b89952ba53f57bf3264779
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\libssl-1_1.dll
          • Size 682KB
          • SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\pyexpat.pyd
          • Size 191KB
          • SHA256 e41cff213307b232e745d9065d057bcf36508f3a7150c877359800f2c5f97cfc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\python3.DLL
          • Size 61KB
          • SHA256 a1c5c6e4873aa53d75b35c512c1cbadf39315deeec21a3ada72b324551f1f769
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\python310.dll
          • Size 4.2MB
          • SHA256 5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\select.pyd
          • Size 26KB
          • SHA256 149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\tcl86t.dll
          • Size 1.8MB
          • SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\tk86t.dll
          • Size 1.5MB
          • SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\unicodedata.pyd
          • Size 1.1MB
          • SHA256 0f27f26d1faa4f76d4b9d79ad572a3d4f3bbe8020e2208d2f3b9046e815b578a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3936-1184-0x00007FF88A400000-0x00007FF88A664000-memory.dmp
          Download

          memory/3936-1303-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1189-0x00007FF889860000-0x00007FF889D40000-memory.dmp
          Download

          memory/3936-1194-0x0000025DD9340000-0x0000025DD9350000-memory.dmp
          Download

          memory/3936-1169-0x00007FF8A54A0000-0x00007FF8A5700000-memory.dmp
          Download

          memory/3936-1300-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1301-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1190-0x00007FF889310000-0x00007FF889851000-memory.dmp
          Download

          memory/3936-1306-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1307-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1308-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1309-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1310-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1311-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1312-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download

          memory/3936-1313-0x0000025DD7320000-0x0000025DD79DB000-memory.dmp
          Download