c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef.dll
Size 347KB
Sample260729-pfzvfstdpg
SHA256 c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef
MD5 62f16aee6d60fee3e0d62e56473b4d1c
SHA1 4ddd39fd0283fad558d63c9d540b644141a7c0a1
SHA512 cb49679c17f61ad83356219f2304320182a61fd015fb245032b6bac07f30f987fc7b582efb85bc91fa3a56417da769594f88d432a8ee202f905c1b3d4fc74909
SSDEEP 6144:Gq/8TB/sK0skAAKEEiPzzmgPBSi1sJHp4V9BKapTGDG+u9HJ9i:H/rKmEiPPNB5kewgGDG+u9p
TLSH
T10574AE0191A80A99E1B682F8C43305468F7DFD49CB60C95B2AA542FD9F37FF5503ABE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
4804	wuaupdt.exe
2420	svcmon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemHealth = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemHealth\\svcmon.exe"	wuaupdt.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svcmon.log	svcmon.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4804	4884	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef.dll
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\wuaupdt.exe
  C:\Users\Admin\AppData\Local\Temp\wuaupdt.exe -k d36deee39830bfb111b50bf8315a4de292812e0d2aafd5fc8666c9db11e8e590 -p C:\Users\Admin\AppData\Local\Temp\wuaupdt.dat
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4804

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealth\svcmon.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealth\svcmon.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wuaupdt.dat

Path C:\Users\Admin\AppData\Local\Temp\wuaupdt.dat
Size 19KB
SHA256 8d217ad2ff7ed9e162cbd20bd207562f7e4f50d3e4d1f36ab01d653380176d16
MD5 d4a0b5b1f5d4f43ff01360d2f16f171b
SHA1 4dc61875f53c58fbdfae8db3e9d5e66c7f5f7db5
SHA512 a719b5e766abdb445523a11c4631d33b093eafc6f9a15ec6565e4da23926efd84bfce63df315a4a2dfb0f11136c4db016de6cd4d015346528984f8f6b846f5fc
SSDEEP 384:GCn1ZJSNWt3tgHichNiZssurAN1fwK1rssfFYEIepFV6Qs/blkuP:GK1ZsQFaHlrCurAX3rssfFqepFVVuP
TLSH
T12E92E18B1AEF6930A77623B0B4920B164513E24E6869584E321227F5C93D7E2CF6477D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuaupdt.exe

Path C:\Users\Admin\AppData\Local\Temp\wuaupdt.exe
Size 226KB
SHA256 28e55dc62f9a9c9938c3b48b2d17a33d6fa96e74c1e9d31f5c685fef8c39b217
MD5 230bb7c97fbb1e96d9ebee43cfa09024
SHA1 8ef97a15935e269c02416f79c4316b6ee81f9d00
SHA512 4e9ecff43c7ff6123b1cd4d3d4ec53f914c8d2f50b7aa14059982b8be0a19efd809445bb685688d595f00a517e7bef51c7b5e9ea641ae16d6117fc0e1357bf74
SSDEEP 3072:JhM3eH6r0m5wksg0mzZMvsuvRuUlHG9+aLSWvy6PP+Yalj1TuKubf5Ql9Tx8:xHfUwksg0gMviUlSSWvywTarI1w9TG
TLSH
T182346C5573B58AF5ECA781398D624606F7727B170722D7DB03A0C266AF13AE04E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4804-7-0x000001A767CF0000-0x000001A767CF5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads