Overview

overview

7

Static

static

3

SystemGlitch.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    1048s
  • max time network
    448s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    07/08/2026, 11:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SystemGlitch.exe
  • Size 29.5MB
  • Sample260807-nsdmbathpc
  • SHA256 a0e2bcf3ef5d4c109e3b10b7755068497b979781d399b2c36b7bbf27989e8a49
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 35 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SystemGlitch.exe
    "C:\Users\Admin\AppData\Local\Temp\SystemGlitch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Users\Admin\AppData\Local\Temp\SystemGlitch.exe
      "C:\Users\Admin\AppData\Local\Temp\SystemGlitch.exe"
      2⤵
      • Loads dropped DLL
      PID:4616
  • C:\Windows\system32\werfault.exe
    werfault.exe /h /shared Global\bd5ce930423948de915ea1cf092e4413 /t 2412 /p 4616
    1⤵
      PID:224
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:1828

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            _imaging.cp314-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\PIL\_imaging.cp314-win_amd64.pyd
            • Size 2.5MB
            • SHA256 d823c0e3b54035d08703bb427c553c956c2607b79395f2952e17a5447c5f1105
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_asyncio.pyd
            • Size 76KB
            • SHA256 dc6db118862ab3298e55e0f7c44c2c0dae4af9e810d2578271280202d6aa098a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_bz2.pyd
            • Size 85KB
            • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_ctypes.pyd
            • Size 139KB
            • SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_decimal.pyd
            • Size 283KB
            • SHA256 8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _elementtree.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_elementtree.pyd
            • Size 135KB
            • SHA256 16f4d30a50fc25950762a8bbef9dd6c5750729345539c224d489be33e6d6f340
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_hashlib.pyd
            • Size 67KB
            • SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_lzma.pyd
            • Size 157KB
            • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multiprocessing.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_multiprocessing.pyd
            • Size 37KB
            • SHA256 9e87ce081fbcf0b6596fcba98e121379ad72a33d68e6b2af7a8bcc5b900229ba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_overlapped.pyd
            • Size 56KB
            • SHA256 ac877f3da413c1523c07b6a0dd1f7e0d7ceb3e8590a5e9e20a78eb1bcb700793
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_queue.pyd
            • Size 35KB
            • SHA256 bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_socket.pyd
            • Size 85KB
            • SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_ssl.pyd
            • Size 186KB
            • SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            auto.tcl
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_tcl_data\auto.tcl
            • Size 21KB
            • SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cp1252.enc
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_tcl_data\encoding\cp1252.enc
            • Size 1KB
            • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            init.tcl
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_tcl_data\init.tcl
            • Size 25KB
            • SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tclIndex
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_tcl_data\tclIndex
            • Size 7KB
            • SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tm.tcl
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_tcl_data\tm.tcl
            • Size 11KB
            • SHA256 f0cc13daca21fee538cca757aa09e88a969a85174eda26e61e573dda6c7ba413
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tk.tcl
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_tk_data\tk.tcl
            • Size 23KB
            • SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _tkinter.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_tkinter.pyd
            • Size 67KB
            • SHA256 a49520e94f19d025a6be6ac7bbb73a7b32442838c62b68c162d44f81d92838ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_wmi.pyd
            • Size 39KB
            • SHA256 0ab1fbcf18c95d70343012feb1aad61e1ba95aaed5b4a08e57fc5990e8a9a452
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\_zstd.pyd
            • Size 491KB
            • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
            • Size 218KB
            • SHA256 3048af5864e17f79410273b3074416d67473eae22b3d7d1b7b58f24a506f82ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\base_library.zip
            • Size 1.3MB
            • SHA256 f045318a9f3183945b2f3ae1f7a242f2a238dfa355a6a987836094291fed53bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\libcrypto-3.dll
            • Size 6.0MB
            • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\libssl-3.dll
            • Size 1.3MB
            • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libscipy_openblas64_-b788215d9d47792bcba3a2e2a7114320.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\numpy.libs\libscipy_openblas64_-b788215d9d47792bcba3a2e2a7114320.dll
            • Size 19.5MB
            • SHA256 b788215d9d47792bcba3a2e2a71143205a57282828a483f1fb071ca2c159f616
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
            • Size 561KB
            • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multiarray_umath.cp314-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
            • Size 3.7MB
            • SHA256 ab5cea76a0fad4fd1bc58667aefba1382a7ce8c147b51cf3bff53eec4efb4ab2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _umath_linalg.cp314-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd
            • Size 109KB
            • SHA256 8264d9d70a1a1d72793805a989fc5ebab8d55970e44a829e1262fd58335ff8d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\pyexpat.pyd
            • Size 217KB
            • SHA256 133942bde91fe43289076a0b50a01b265df4ead078617cca6f6604a4166e1260
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\python3.dll
            • Size 72KB
            • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python314.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\python314.dll
            • Size 6.5MB
            • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\select.pyd
            • Size 32KB
            • SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tcl86t.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\tcl86t.dll
            • Size 1.8MB
            • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tk86t.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\tk86t.dll
            • Size 1.5MB
            • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\unicodedata.pyd
            • Size 741KB
            • SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zlib1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27042\zlib1.dll
            • Size 142KB
            • SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4616-1068-0x00007FFFA3FB0000-0x00007FFFA3FD9000-memory.dmp
            Download

            memory/4616-1069-0x000001DE7CF90000-0x000001DE7E310000-memory.dmp
            Download