Analysis
- max time kernel
30s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FrenchPacket.dll
Resource
win10v2004-20260513-en
2 signatures
30 seconds
Behavioral task
behavioral2
Sample
FrenchPacket.dll
Resource
win11ltsc2024-20260709-en
3 signatures
30 seconds
General
- Target FrenchPacket.dll
- Size 3.6MB
- Sample260718-cmpa3sgw7z
- SHA256 d854068fcf96af15cee1c9d29627ece469126eaeba1e4786e2547167c6d5b21d
- MD5 e4b49f966c8614da26759cc623ba2bca
- SHA1 0b519cf7515f8570df4ab04e54d45808c80ca9ce
- SHA512 a883f7a48bf1ab6fccd386cc87917f9b64dfc40e68386d9e998d5990170e638abfe9181f710181988a6943a8833f4c50c3c39ddd880954c04155045579d55d03
- SSDEEP 49152:POCY84uV5DvuHs/RopkoINzkg2y64oTx7STTgoZTiBmhe6Ra9gt+KSMZJGA1S9IQ:cu
- TLSH T14E066286DAB681E0D6BAD138B252722BFD213C5DC73867E79BD05B0257A17D0E5BE300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3820 rundll32.exe 3820 rundll32.exe 3820 rundll32.exe 3820 rundll32.exe 3820 rundll32.exe 3820 rundll32.exe 3820 rundll32.exe 3820 rundll32.exe 3820 rundll32.exe 3820 rundll32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1772 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1772 AUDIODG.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3820 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\FrenchPacket.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3820
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772