a2894f7d7c42c293f16777a4c220baf0dbfe6f54a8e8fb6f238f11b1214f2003

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/07/2026, 18:12

Target
bitsandbytes/backends/triton/kernels_4bit.py
Size 21KB
Sample260713-wtk2saft71
SHA256 a2894f7d7c42c293f16777a4c220baf0dbfe6f54a8e8fb6f238f11b1214f2003
MD5 f86f210ad71485f7899f16a0f1c76fed
SHA1 29c04d7606d83641af69929bcd2a2a1363ab0217
SHA512 46f6ca2648c72df670f2f8d055f80a172db1f7526d60724d6de72136b58437d2fa466c8adc4faa731a3c108a366e1f606cc29ffd62addc65fc4e75db2c106107
SSDEEP 384:bGhxnzKDYQIkhxnzK8YQhsEoEEEoEdO96ZjOfOk1yHKuELtHALyHKEHELtH+yHK5:bAJPQIyJsQhkEcEdG8HK1tHA2HKE2tH6
TLSH
T1B5A2761FD588284EB35159B9ED5F1FD19F18125BDDC32588BFACCEB42F0B9782102A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4760	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bitsandbytes\backends\triton\kernels_4bit.py
1⤵
- Modifies registry class
PID:4116

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact