Analysis
- max time kernel
300s - max time network
281s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 03:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8-13 Statement of Account.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
wmicodegen.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral3
Sample
wmicodegen.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
300 seconds
General
- Target wmicodegen.dll
- Size 379KB
- Sample260815-d3lessywfs
- SHA256 263a2d7cfa475fc51b7932928293268e9bb0fa3fadd746cf4192c31234c77ed5
- MD5 7aa5f86f80c2a6c9493470dd365f2a43
- SHA1 5938c874a19db18b0b246d26075de46b193a22d2
- SHA512 5d3e3418395c973e2d19ec314c4ef2773f4e5946dac702259ae613ec984b81e14a695a9220745f2cd6a14c9fdff80cfcf98428996c814b7123d57ea768a5da9a
- SSDEEP 6144:5ajaMInUvUHUoJtnh+hD1AlCfAppX83h6tCd4ZBerjrSfMLP9+ijiA0BM2q8pnKI:5RMvU0obQt2lCfY84YGZBerCQPupmWDh
- TLSH T1F6841242B13B28F5E099D67DD8928858DB3278045324C97FB31AF0A83B7B979714E74B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 240 rundll32.exe 240 rundll32.exe 240 rundll32.exe 240 rundll32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4516 explorer.exe - Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe Token: SeShutdownPrivilege 4516 explorer.exe Token: SeCreatePagefilePrivilege 4516 explorer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4516 explorer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 240 wrote to memory of 4516 240 rundll32.exe 80
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4516 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\wmicodegen.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:240
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3224