3421b88061d1976230c546895bf71007e53013f118699c72e7026c6a36ea0dc3

Analysis

user interaction
yes
max time kernel
71s
max time network
74s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
patcher.exe
Size 7.9MB
Sample260720-rr89dacz8r
SHA256 3421b88061d1976230c546895bf71007e53013f118699c72e7026c6a36ea0dc3
MD5 b28fad382a45c63e1ac046cf8d1fd6b6
SHA1 b3e07f365319e557391c27fda76d47e79cbaf74b
SHA512 893b016b31111e444f8dc3fe217dac6d296877a82a00e8584593813410c681a567130834812a105507881199d24f884f99ee4330cbcfff6eda606c641e68694a
SSDEEP 196608:cCNTwhLE6urH3Q3qemdUSCtmk0ax8UoMi6o8M9qgqmz:cPLE6u76mdUSC4axKzw2
TLSH
T188863358939409FAFEF7D23EC6238906C27678516B62C5E707E043822E336D53B3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4148	patcher.exe
4148	patcher.exe
4148	patcher.exe
4148	patcher.exe
4148	patcher.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6124	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 4148	5780	patcher.exe	89

C:\Users\Admin\AppData\Local\Temp\patcher.exe
"C:\Users\Admin\AppData\Local\Temp\patcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\patcher.exe
  "C:\Users\Admin\AppData\Local\Temp\patcher.exe"
  2⤵
  - Loads dropped DLL
  PID:4148

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a22855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_bz2.pyd
Size 84KB
SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
MD5 77294e590d14a22d98862c141e7ea4ae
SHA1 88a64817b0699025fcb1dda533355a0b30bd92bf
SHA512 3dac79115a510fd09d384829ff1b45864c2bd20db34459c5ac84ccb65f2befe5d59e13cc232fa23c77232421886a8eefa8d6b5986199e32d2953fee92dad0abd
SSDEEP 1536:HdsvXm8z7+Cnqncm4WlTtdKSzBdIM8vOBs8iMdIsLVuyEJ7Q9bfIgHX:9svXm8zaYqRptX7IvvOC8hdIsLVyY
TLSH
T1B6837D86F36542B6F99BD1F886800793FB30BB950750A3AFF148C2992F13B916E5C219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_lzma.pyd
Size 155KB
SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
MD5 a0e27c2f376dc80dfc3f884963a0f416
SHA1 f2738a7e6dc65cd9b915a33af354d2f04b768712
SHA512 6e0c50e52e48b29098fa3b7614f190ecc84ab12ed3b376e7e7148f84eceb3101b9ea6972f100b5478059f62d90aded0dff8522440728d0c0904d8c70457f734e
SSDEEP 3072:xqZ/boPLmhrKifqGDRJUs0znfB9mNoTvm28fgS+dIs01xMW4Iiy:xeTgLhyvUsq5YOTCfd+E9
TLSH
T178F35C86B794F0D5F7728C38D6628F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\base_library.zip
Size 1.3MB
SHA256 0054b6640cf37f66af5480cf78b51a8b830509c7bd4734f2606b9b2117fc1299
MD5 469ae2fc960f923122a786329b0f5553
SHA1 a3cce9e83ea5fbe1d02283925ef5ee2b37816273
SHA512 5045b80735be7b90342f8c8fd22ff18e8c0e8f6d101fd76738dfe8b41775adc962eb497c1c44e39d1ae2dc79ab63f73f7c22cc3214570bc1b72654632eb9df90
SSDEEP 12288:mORbsW7Wp3djdTji2cPPdxhYy6YtYzGNcT1fL+DnuIva80201jwCVRDVoioSYBh6:RN7Wp3dZj5cPPdxhYHSeT12lhrq/X
TLSH
T1C9550992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\python313.dll
Size 5.8MB
SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
MD5 cfbfd5ca1d563466687e53a638eed93c
SHA1 63bffe9d62dcc870b1601ae7a04b042df88fa219
SHA512 0eb973271a12ff17dc443ee3289695bb2134d66120690d067b3f67b4b52a5ac2831f326fe85635ef43799b43574e4e1809e20db6ae1d32b5e5f4711cfa12df36
SSDEEP 98304:efqPAKrV+hOhkH0pwgJYt5FO8vUHDMiEJV0KL:DPAC+hOhZaic0A
TLSH
T11F568D12729D50ACD97B8078CA178A4BF7B27C113F60434B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads