Analysis
- user interaction
yes - max time kernel
48s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
31/07/2026, 10:59
General
- Target Walftech Fix.exe
- Size 63.0MB
- Sample260731-m3hhkshb36
- SHA256 01beef74a6aeca4b89e8cdea47bcf38afe162471aaa418bc092922a64b3976b5
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Walftech Fix.exe"C:\Users\Admin\AppData\Local\Temp\Walftech Fix.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /Query /TN "WalftechFix"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/3552-5-0x0000021627080000-0x0000021627D10000-memory.dmp
memory/3552-9-0x00000256BE6B0000-0x00000256BF610000-memory.dmp
memory/3552-13-0x0000021627F40000-0x0000021628170000-memory.dmp
memory/3552-17-0x0000021628170000-0x00000216282D0000-memory.dmp
memory/3552-25-0x0000021625D80000-0x0000021625DC0000-memory.dmp
memory/3552-21-0x0000021625C80000-0x0000021625CD0000-memory.dmp
memory/3552-29-0x00000256BFE40000-0x00000256C0670000-memory.dmp
memory/3552-49-0x00000216293D0000-0x00000216293F0000-memory.dmp
memory/3552-45-0x00000216282F0000-0x0000021628310000-memory.dmp
memory/3552-57-0x00000216296C0000-0x0000021629700000-memory.dmp
memory/3552-53-0x0000021629610000-0x0000021629630000-memory.dmp
memory/3552-41-0x00000216263D0000-0x00000216263E0000-memory.dmp
memory/3552-37-0x0000021625E20000-0x0000021625E40000-memory.dmp
memory/3552-33-0x0000021629350000-0x00000216293D0000-memory.dmp
memory/3552-61-0x0000021629650000-0x0000021629670000-memory.dmp
memory/3552-65-0x0000021629770000-0x00000216297A0000-memory.dmp
memory/3552-69-0x0000021629720000-0x0000021629740000-memory.dmp
memory/3552-80-0x00000216297C0000-0x0000021629810000-memory.dmp
memory/3552-76-0x0000021629950000-0x0000021629A60000-memory.dmp
memory/3552-84-0x00000256C2C00000-0x00000256C33A0000-memory.dmp
memory/3552-88-0x00000256C20E0000-0x00000256C2110000-memory.dmp
memory/3552-92-0x00000256C2210000-0x00000256C22A0000-memory.dmp
memory/3552-116-0x00000256C34B0000-0x00000256C34D0000-memory.dmp
memory/3552-120-0x00000256C3840000-0x00000256C39B0000-memory.dmp
memory/3552-124-0x00000256C3CF0000-0x00000256C3D40000-memory.dmp
memory/3552-112-0x00000256C3460000-0x00000256C34B0000-memory.dmp
memory/3552-108-0x0000021629670000-0x0000021629680000-memory.dmp
memory/3552-104-0x00000256C22D0000-0x00000256C22F0000-memory.dmp
memory/3552-100-0x00000256C33A0000-0x00000256C3460000-memory.dmp
memory/3552-96-0x00000256C22A0000-0x00000256C22D0000-memory.dmp
memory/3552-133-0x00000256C42A0000-0x00000256C4300000-memory.dmp
memory/3552-137-0x00000256C3690000-0x00000256C36D0000-memory.dmp
memory/3552-141-0x00000256C2440000-0x00000256C2450000-memory.dmp
memory/3552-145-0x00000256C4400000-0x00000256C4470000-memory.dmp
memory/3552-153-0x00000256C4380000-0x00000256C4390000-memory.dmp
memory/3552-149-0x00000256C4670000-0x00000256C47D0000-memory.dmp
memory/3552-157-0x00000256C4360000-0x00000256C4370000-memory.dmp
memory/3552-161-0x00000256C4B60000-0x00000256C4B80000-memory.dmp
memory/3552-165-0x00000256CBC40000-0x00000256CBDF0000-memory.dmp
memory/3552-173-0x00000256CB9F0000-0x00000256CBA60000-memory.dmp
memory/3552-169-0x00000256CB9B0000-0x00000256CB9D0000-memory.dmp
memory/3552-181-0x00000256CC300000-0x00000256CC500000-memory.dmp
memory/3552-177-0x00000256CBF60000-0x00000256CC010000-memory.dmp
memory/3552-185-0x00000256CC500000-0x00000256CC590000-memory.dmp
memory/3552-189-0x00000256CBE60000-0x00000256CBE80000-memory.dmp
memory/3552-197-0x00000256CC590000-0x00000256CC5B0000-memory.dmp
memory/3552-193-0x00000256CBE80000-0x00000256CBEB0000-memory.dmp
memory/3552-201-0x00000256CC5D0000-0x00000256CC600000-memory.dmp
memory/3552-205-0x00000256CC770000-0x00000256CC790000-memory.dmp
memory/3552-210-0x00000256C4480000-0x00000256C4490000-memory.dmp
memory/3552-214-0x00000256CC9B0000-0x00000256CC9F0000-memory.dmp