fc11ec883f6552e69b00dc71b8ece86e888525cd5f13bab3a892523f0637e5d4

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chara/Chara.exe
Size 371KB
Sample260807-lnbwtavvhs
SHA256 fc11ec883f6552e69b00dc71b8ece86e888525cd5f13bab3a892523f0637e5d4
MD5 99f0eb5663d81521e070dbc66052c01f
SHA1 5745423160bafcaaa4995d563fda42087f4e5296
SHA512 1bb170c378177ef5187e07f7ef82416c5d92750b834b44d1b1d3975038470cd62f4040f62c30c98fda8de6f31d4f64f0f45a6ce0092e9b1002cc865c546f6f0f
SSDEEP 3072:m0lY8Q2GzuPBDp5666W6pt7wOowt4T/cd0igNki:TJGzuPBCPti0Sit
TLSH
T10B841B3716077285F80D1F73F66E5CCA8C15D5839E51EEF8EBAA2528A27D24C4ED128C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4960	Chara.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	Chara.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4960	Chara.exe
4960	Chara.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1940	4960	Chara.exe	84
PID 1940 wrote to memory of 4912	1940	csc.exe	86

C:\Users\Admin\AppData\Local\Temp\Chara\Chara.exe
"C:\Users\Admin\AppData\Local\Temp\Chara\Chara.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dd0cjyo3\dd0cjyo3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES241D.tmp" "c:\Users\Admin\AppData\Local\Temp\dd0cjyo3\CSCD4F18A0ADFB6469B95F9242B549CE09E.TMP"
    3⤵
    PID:4912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES241D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES241D.tmp
Size 1KB
SHA256 c923cadee11eb46300d20bf3698086bac88c9ab85f0acc5864f43b7031e85dda
MD5 a6378d21f0e3d3ad69c69900446463ea
SHA1 62988a99638efa4e4d15643d0a6d82082fa1922f
SHA512 bf580c9a23017030b811a83059021de620b7af5bc57ea655841f62b916118376084907b15aa71f23c41b2652e9ca770835bffc84962bb164487474133e54d968
TLSH
T15521CC0453F8471FF073973269FA572BA275FDA4EF62535B854012681C41614EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3n1g3en5.wlq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3n1g3en5.wlq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dd0cjyo3.dll

Path C:\Users\Admin\AppData\Local\Temp\dd0cjyo3\dd0cjyo3.dll
Size 3KB
SHA256 3d7a296391cdbdc13cd9186b39812a78f61257f1278cc842bf73286e77c0bee8
MD5 44e4931dfcb5c67e475a8025fc443776
SHA1 21cd1dc305bd8a2dd2afc8b49402cdd215ac68e7
SHA512 b701c24da2e7eace67dc59c105c6e74382236f702b389e9e3de21c4dac26989f50c027e80e71a8a569dacd9a9a8b9b13fc1bf9a36a067294138861c8fce1e624
TLSH
T12C51E906A3E84A6BE4770B34ADF3472637B8FC509F73671E09800218ACA57645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD4F18A0ADFB6469B95F9242B549CE09E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dd0cjyo3\CSCD4F18A0ADFB6469B95F9242B549CE09E.TMP
Size 652B
SHA256 5f9d7989e75cbe61dd78721f4b53978910416acd3ffc914425f6a80f35d6f328
MD5 ce10c81ca11f941e6d667f14e0570e3d
SHA1 5c5e3fecfc8f9558323ad8db5c28e75a1e5052ff
SHA512 e707ed0f55b4e4f7de82d6dc0560c0d9b467c0ae569d5c202953f78d84818bb6841f900db7a16514fe071c5d60a24ecafb5366af22a1e279ba33571e3433a0cf
TLSH
T18EF05E0963F8020EF0F34B71BDF6436395A8BC65DE3293ED154003592C64A209972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dd0cjyo3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dd0cjyo3\dd0cjyo3.0.cs
Size 289B
SHA256 653db0e789c211da9508812458c3ea646761b62760d19be2997d349c3673afee
MD5 2dfa104ea733fa32063cbb6924aeba42
SHA1 cea2e4784b912dded633afec82c803793b76290f
SHA512 8d866cd95d01648bda04819d6bc8acf72b73a3f448d9853836f4724dc83b50536fd5f85448f907d6b4089232fbb9444150c0b8150e36802b77613729cef11df2
TLSH
T128D0C2146AB2EA704033841A8C8BD0BEB70BA466266A19007AA51310EF8B00A8225A5A
MD5 SHA1 SHA512 TLSH

Submit Download

dd0cjyo3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dd0cjyo3\dd0cjyo3.cmdline
Size 369B
SHA256 e51c600d853af84d27cc2460ff0f4e8ea27d8baa80a93025593572e75ef308dc
MD5 bbce5197815650b7b728360c931a3177
SHA1 9c77138d7b6aadddbb98a4b8618b023f14ab1ff6
SHA512 a9ef5e7a6a2d2c5a1fa6e226cf17438c3461c871835ffb59a53147fc2b0cf9588228a60a9456ba4dbeae049ec86903b247b8e573dbcdf5871d14372dfd42470c
TLSH
T10DE0682E4346C6BD22E9100F216BC4ACE67247C32A403F865860640EE217004BFD1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4960-0-0x00000000005A0000-0x0000000000602000-memory.dmp

Download

memory/4960-9-0x0000000000ED0000-0x0000000000EF2000-memory.dmp

Download

memory/4960-8-0x000000001D470000-0x000000001D480000-memory.dmp

Download

memory/4960-22-0x0000000000D40000-0x0000000000D48000-memory.dmp

Download

memory/4960-23-0x000000001D470000-0x000000001D480000-memory.dmp

Download

memory/4960-24-0x000000001D470000-0x000000001D480000-memory.dmp

Download

memory/4960-26-0x0000000026D70000-0x0000000027516000-memory.dmp

Download

memory/4960-31-0x000000001D470000-0x000000001D480000-memory.dmp

Download

memory/4960-32-0x000000001D470000-0x000000001D480000-memory.dmp

Download

memory/4960-33-0x000000001D470000-0x000000001D480000-memory.dmp

Download