Overview

overview

10

Static

static

10

Claude Setup.exe

windows10-2004-x64

7

Claude Setup.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    46s
  • max time network
    45s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/07/2026, 22:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Claude Setup.exe
  • Size 13.1MB
  • Sample260726-142jqsstdw
  • SHA256 80e5c9896391451b433684243b2a4e4b9e15eda43021a8e65eec26d10c208644
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • UPX packed file 32 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"
      2⤵
      • Loads dropped DLL
      PID:1776

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_asyncio.pyd
        • Size 41KB
        • SHA256 acaf61883134f46fc51b744c0babadf6812ebf3aa6feef6a94f81229a72ba5dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_bz2.pyd
        • Size 51KB
        • SHA256 0d24b6b5d4c9587ddedc80555a71b95bb21aebf0b8f8d0c6d156fabe01e9cfc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_ctypes.pyd
        • Size 67KB
        • SHA256 7912249eb8a96148b9ac835adcc449b57bbbf11f46ade25116afbbbb5f5d1e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_decimal.pyd
        • Size 121KB
        • SHA256 5c3920ded9db2260a387cfbddcb62526a5943f22689084404178f797ad2ea1c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_elementtree.pyd
        • Size 63KB
        • SHA256 8e79fa5725ee209d4fd0b3e39415ea7f3c9736c826c458f740ed7a485837543b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_hashlib.pyd
        • Size 38KB
        • SHA256 5d13e923dfb563120dd1b0cda1da3f753d9b3f7e3ff81a13c88ecfabbaa5ab97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_lzma.pyd
        • Size 88KB
        • SHA256 abc55cef34e979d9cb8ac55fe2de2eb7a4bced26323c602fa718cf99b48e5fc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_multiprocessing.pyd
        • Size 29KB
        • SHA256 caa25b8e153b7c641aee2e5267d62e7757eca8ee82023f03983d3f079c021fd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_overlapped.pyd
        • Size 36KB
        • SHA256 e8da68a1bc027afa4e0f723d5f2724b8cebc22ac4bb14bb5407858b502678b06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_queue.pyd
        • Size 28KB
        • SHA256 32769c0d60d4974911307e5c471c8221b905a100340efd2eb82f1aa86ef6a914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_socket.pyd
        • Size 46KB
        • SHA256 e7d6bd7796cdfdc3e09a8df07c9c40435ba5da581afcdff617602b1c3169a06e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_sqlite3.pyd
        • Size 61KB
        • SHA256 98b5ef465c121b948cdebf08e5e70cd4848b1de49cef46519051187642289fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_ssl.pyd
        • Size 69KB
        • SHA256 c2a680f50519b939af59294f0560502161bc931a64081aa88165a7429fac91c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_zstd.pyd
        • Size 176KB
        • SHA256 4d7be683dd124a8599c5447ecc9cf3ab586473ed391c04ad04c2956312b5be09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\base_library.zip
        • Size 1.3MB
        • SHA256 bdfb173844309a43ea0d39377f5a088bb88e9473205ad90cbe68b3f3076a7b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\libcrypto-3.dll
        • Size 1.6MB
        • SHA256 d2f0674053bc0d8ba9fc622d42e9f6b8e32e765eeead1bc741058611b921436b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\libffi-8.dll
        • Size 29KB
        • SHA256 e9d8eb01bb9b02ce3859ba4527938a71b4668f98897d46f29e94b27014036523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopus-0.x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\libopus-0.x64.dll
        • Size 217KB
        • SHA256 fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\libssl-3.dll
        • Size 369KB
        • SHA256 ca79c93988129312b9ffc63f022ea20cb880140e39c3224e96ec3f5b4fa8b12a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\pyexpat.pyd
        • Size 95KB
        • SHA256 727601bdfe84be247ada3ecf99811557ecd1120c18c71bdbc11ad38ae873ee95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\python314.dll
        • Size 1.9MB
        • SHA256 209cb813e576709cddacc996095a698475278b57b5c6f684c3ff484689e8978e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\select.pyd
        • Size 28KB
        • SHA256 a79b7dab8c3fcf9d3e5d9bba5623c67123b4d7040c0e6ef645c7c0ffcb047fc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\sqlite3.dll
        • Size 663KB
        • SHA256 3ec6df25ffbb9efb68827e8d975c0acf8849e12b8d71e03cd99302b7c2a7a4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\unicodedata.pyd
        • Size 277KB
        • SHA256 cd023cc0360126e989af06284c0eb449ca39969702e5961e899aafc9d18bea44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1776-36-0x00007FFA04E70000-0x00007FFA0557D000-memory.dmp
        Download

        memory/1776-65-0x00007FFA12AB0000-0x00007FFA12AC4000-memory.dmp
        Download

        memory/1776-62-0x00007FFA12690000-0x00007FFA126B9000-memory.dmp
        Download

        memory/1776-63-0x00007FFA1BF70000-0x00007FFA1BF7F000-memory.dmp
        Download

        memory/1776-67-0x00007FFA04830000-0x00007FFA04E61000-memory.dmp
        Download

        memory/1776-68-0x00007FFA04E70000-0x00007FFA0557D000-memory.dmp
        Download

        memory/1776-69-0x00007FFA12690000-0x00007FFA126B9000-memory.dmp
        Download

        memory/1776-75-0x00007FFA12AB0000-0x00007FFA12AC4000-memory.dmp
        Download

        memory/1776-74-0x00007FFA04830000-0x00007FFA04E61000-memory.dmp
        Download