1f6babb561bd34844e7ff420469b84c0f248cef65eaf28f65291b3c011abe9e3

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VueScan x64 v9.7.93 Patcher v1.0.exe
Size 79KB
Sample260731-1rtclasaqe
SHA256 1f6babb561bd34844e7ff420469b84c0f248cef65eaf28f65291b3c011abe9e3
MD5 b8ebf088dc7dfdbe8f4a02dd880d092c
SHA1 a56c5d316b76232dd012ef019378758feb8a1ced
SHA512 c1188d37f830ffd0f62d175d9df0e9b408e023e7a7e321cfe15c75ee877dfdd592050b260de14d9cbce06fee6cab647e19ce9a612867d339ed7620ea6cd55884
SSDEEP 1536:OhN0rbd6+wnj+CsMyNPdAEIFMfHCiqL5Zw610ICuu5WBkeUNjgoD9OKxs6g:Oho6JjYdAEIFMfHCiqL5O610ICN5WBw5
TLSH
T1AB83F1827C4669E6E0944971649BC5F78D7F4E1217B6322F73C83F0B7E223E38612969
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4344	VueScan x64 v9.7.93 Patcher v1.0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VueScan x64 v9.7.93 Patcher v1.0.exe

C:\Users\Admin\AppData\Local\Temp\VueScan x64 v9.7.93 Patcher v1.0.exe
"C:\Users\Admin\AppData\Local\Temp\VueScan x64 v9.7.93 Patcher v1.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dup2patcher.dll

Path C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll
Size 60KB
SHA256 5de2dcff00ff5871702d4ce200c49044ce6b641a18ca3c3da50c4b6005f424d0
MD5 e1a2b9efd75c5fc82afacf0823b2717a
SHA1 a05d849fb076683e6b7413c363dad7b99890ce57
SHA512 86e2e6cdc34923cb6092ff2c233983248d77300ea5bf3fd2ec7f33882479d20e092b987c363873073ca21f6e770972938e0a83762904a8cca41ccf9d3530a3dc
SSDEEP 1536:I/Tilc2ldltF9j6RW8Hj/1lxC+oU0ODb9I:KTYc2ldltF9jWW8Hj/1lxC+oU0ODb
TLSH
T1DA5309547E97817DC39017352CE58F6086686F31E660E0179F3C1E2CAF61A92EB1BE32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4344-3-0x0000000074EB0000-0x0000000074ED7000-memory.dmp

Download

memory/4344-5-0x0000000074EB0000-0x0000000074ED7000-memory.dmp