d4ceea5b4dedc5965ee5c6ae072503b7963908c054cc5e9b26d2986446f45abf

Analysis

user interaction
yes
max time kernel
60s
max time network
51s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hello2.exe
Size 4.3MB
Sample260729-tsmswabc58
SHA256 d4ceea5b4dedc5965ee5c6ae072503b7963908c054cc5e9b26d2986446f45abf
MD5 867cdf5e42c18f6c6e15dc13c32e7ce9
SHA1 8e36016df5c05fd1baf19012e38df89b87513d3d
SHA512 e942092e4faa54eb517542ef8926e280b033057205be2210252ea127ce74de74c140f152b2e2498cadd3378d61d97c4c5a9e4a86de8ab7b31d1a3680ef635b9d
SSDEEP 98304:Odd+3sGAGIjERqRard6XVZ7a2xrkRt0KzlEvC5D4H7LU:Odd+883RqRmgVBa2lkr0KzlEamH7A
TLSH
T155263354F3D001EEE277D13BD466894AD3667841236218CF4BB50A7EAFB76E40A7CE12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
5464	hello2.exe
5464	hello2.exe
5464	hello2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	hello2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	hello2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	hello2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	hello2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	hello2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	hello2.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 5464	5856	hello2.exe	89

C:\Users\Admin\AppData\Local\Temp\hello2.exe
"C:\Users\Admin\AppData\Local\Temp\hello2.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Users\Admin\AppData\Local\Temp\hello2.exe
  C:\Users\Admin\AppData\Local\Temp\hello2.exe
  2⤵
  - Loads dropped DLL
  PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5856_633624_oBTR_UrYdyw\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hello2.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5856_633624_oBTR_UrYdyw\hello2.dll
Size 4.9MB
SHA256 0c20f26bcb5e607887a95dc7fb389b159168877a4c050356ebc55bdd8245e5d3
MD5 a4c669185f12b6647cacb0dc71fd01c4
SHA1 a900377dadb206119b020883712995d2d7fd9abb
SHA512 464e0b35c273bd8589649594d9c700d62fbc7bba7a49adbd2423b6258dd9078a72596709eb18738ee9ca6c3b10f2d87f4af4538e680e60d9023c1f7c6c935297
SSDEEP 98304:DzLl+10qj1DSE1E2uvXeCow0uT6y1/Z5:rl+1lj1y
TLSH
T169365AA5BA905927FDD9F17932A75A44E722C016A300D343F07C88AE7F9E760DE7168C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5856_633624_oBTR_UrYdyw\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads