Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 16:55
Static task
static1
Behavioral task
behavioral1
Sample
hardwareupdater.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
hardwareupdater.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
hardwareupdater.pyc
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
hardwareupdater.pyc
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target hardwareupdater.exe
- Size 8.3MB
- Sample260811-ve97pahn91
- SHA256 af546b4d2440c6133f78d3bacebc304cd73531ea8806fc4fe996d165d8929722
- MD5 210dee9fcd68b44b536b2a7b4441893b
- SHA1 48197ed0c0a1a924d11b5b084956b825999a9fca
- SHA512 6dfb48e508b77248fce9582c2ce2b3e9330101c7aa1f8eacfe9f8c797e402f11b08583d7dfddc5095ff30b8ecea11dcb3951252c99448839c76fed36218829c5
- SSDEEP 196608:sfztsz6nxuBwB9drbdXQaN+MofR4RmhErHswqKpCTFeE7Et:8yzmx/hrbdXQfM6R4Rmh4HswqKiYt
- TLSH T1BC963359A2E011FEE4A3513D4D74D21AE6B1BD220B62C9DF07E44F2B2F676E11C3D229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 2428 hardwareupdater.exe 2428 hardwareupdater.exe 2428 hardwareupdater.exe 2428 hardwareupdater.exe 2428 hardwareupdater.exe 2428 hardwareupdater.exe 2428 hardwareupdater.exe 2428 hardwareupdater.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3308 wrote to memory of 2428 3308 hardwareupdater.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\hardwareupdater.exe"C:\Users\Admin\AppData\Local\Temp\hardwareupdater.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\hardwareupdater.exe"C:\Users\Admin\AppData\Local\Temp\hardwareupdater.exe"2⤵
- Loads dropped DLL
PID:2428
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33082\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33082\_bz2.pyd
- Size 85KB
- SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
- MD5 98aa4ec9b691267912bcb3336fc7cafc
- SHA1 8955d7e923c4bf05d84a03666ec8cdb4fab2f616
- SHA512 62084c7077ed896b92055e5a278651d6eeca65622321e389e551e8a331b51c9fe2a5eb1b903eaed41117a7a8efce514b9d62acf2b62985d1535812ab59011387
- SSDEEP 1536:w1sxz74jpCk2wWdyOeR3RYZvksL8DdRbEvtwIA3V4y7NsR9KfIkWO:GsxzsIdtYOeRuZcsYZlitwIA3VU
- TLSH T162838D82E3A462B7F59F91B4D7810753F730FF560710A3AFB25482863F12B91AE58366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33082\_ctypes.pyd
- Size 139KB
- SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
- MD5 409e2c98beb0554395f65fc8b55951c7
- SHA1 f7e25afa8bd80fa8ed709aed8ced4374c0f1ed93
- SHA512 8babb6fe295975868c1aa57c63dcab6f2cd151ba7074848dc7da27de2ea46a886496754b7c7e09b043ec5dc2813d30cbdbaa136f0f26302a1b7246a5da7962a7
- SSDEEP 3072:5Dpx2Lp7KR+FrkdOJWWcovIXBzTKRFyxpMIAGPwuTkY:tpxCtKUr8WDvIXBnU8xppkY
- TLSH T1DDD38E4B736840A6DA678138C6739E47EBB1F4521A1087CF4264C99B1F633A2AF3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33082\_lzma.pyd
- Size 157KB
- SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
- MD5 d5e9416137026497171e131dff6e569f
- SHA1 16de80a710940e38537d1d2aea22bc33d5948591
- SHA512 e7cb2a3c68e7f5129a4712b38b81fc84fc57881bd1d087c755ba16ee6d892be7ec0708a30465d2a28fe9b587226f233e02a2f512f861ad58012b5b80fe7c1927
- SSDEEP 3072:QJ66gwnM5uNIJfuPdX+ENYQrHznfx9mNopUpdgwIAI1ho:QURwnNIk1XrBrTpYOQgL
- TLSH T11AF35C86B794F0E6F3628C38D6624F57E6F578190320929A01CC976D2B1FB759A2F313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33082\_zstd.pyd
- Size 491KB
- SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
- MD5 a75e9eb46c217f915fb8db1deed6dbb3
- SHA1 b7e1bb9e18856a93b405c8adff3a198695b37d50
- SHA512 c160a4681d9e5ecbeaa9416e294883fae9a212e28a8fdee5b86181f7e1cb35b9f1352e2af7894ae1023fb839e75d4fcaa4c5bc61024bd7cf0e261e21edb02cfb
- SSDEEP 6144:dZ87M+EgY9pB2l1eUVcnmw3Vh4S+zKhThruVxzeeO07WEz9LKE+UIHHHRToSH2l4:vNcumw3vT8eeOyWEz8xHnRTrWl93R9D
- TLSH T17AB48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33082\base_library.zip
- Size 1.3MB
- SHA256 fd16becb9debd4969e088e0137ac496d267b0faf4489117aa0104a1e5171bed0
- MD5 c0bd2607363a57b5a32b568c7586175f
- SHA1 efa528799410cbbe450e332b6c04e6fe2b173051
- SHA512 c7252eb515b27b3b9fa018a5a8a5f88c53bffa9e76d0c8a7e0f10706cdf55ce646a995dcbbd13516fb6cb6f6d5900dc59bc98725e6e83af0c7662485677e8a60
- SSDEEP 24576:aRpreHp3tuUFKpQeOdP2m2dfAUdMlblLBM:aREp3tuUF+/hdD
- TLSH T103552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33082\hidapi.dll
- Size 158KB
- SHA256 ebeb835e2b4530ed68843f19d6a2604c51772e3c26e7f542fde194075f82d9b4
- MD5 8f3d7117bf6ca37f5a608ced4495552b
- SHA1 52faac503cdda9dfe1587b1acdf0b09fba3e4815
- SHA512 1ce3d3762ac556469b612f9a9ad49c73a9403d526af5340e78489c597b22ae502671ec166fc2cf2e815b250fb48f1d2d8fda2b3462df60b852e984aa9df58e45
- SSDEEP 3072:O/pBvlRK6SDOa1wKRV29mp7SbaNJ013NyKZAMjLtCH:O/v9RUDOMwKRa+7SbaP0/Zo
- TLSH T102F36B0772E500BBF9B79634C8A70606E77378125B60DB9F03A4477A5F277819E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33082\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33082\python314.dll
- Size 6.5MB
- SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
- MD5 e823b990ba85afa143b799c291058dce
- SHA1 3e53a71a5c72c3011bee19a792a6552a0d702671
- SHA512 fc9b0a6795993e1c4519622726647c33c415a9aa9983daa52d1f9f371c58fb74067599052f5b9c25f5acc08ed15021221dc524543a4de87b5705bba145a1b622
- SSDEEP 98304:6PEfNNEwwP1Fyh4NIyDB7Qfo7wavAHDMiEuGC:tfXEwM1Eh4ayDpji1
- TLSH T180669E26737401A5D9BB8035CA074647DBB1BC00AB30D34B59A47ADA3F733635BAEB85
- MD5 SHA1 SHA512 SSDEEP TLSH