Analysis
- user interaction
yes - max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
example_win32_directx11.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target example_win32_directx11.dll
- Size 6.3MB
- Sample260822-2h7paszfpg
- SHA256 af1af0241f373ba199b7cbe9670b682eda246364dc21ea237846d14c694b9259
- MD5 97909faadddcd820d239ec5430970e86
- SHA1 4df9da35db377e5d78275029f9ee21e39fb72ae2
- SHA512 1f0524a96b115340be3efd84f5420aa2d1bb86596a6eaa27e1339b3e4f0157a0db7593d932e6fe6c4c1f647cc035a2a9af023a6a2f8d548e2e160e19234c841c
- SSDEEP 98304:w6Ey3vjVGxTpGTZ00QvuPomld/CoDZ1Jsc+Tq+5DQwgrY67Cb:REy3rVaTpGW7mPomKoDZUZHgczb
- TLSH T16C660146E2978238DF67573984669333D6B07CC443A08BC76BAD89746F63AF06A7C740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5116 taskmgr.exe Token: SeSystemProfilePrivilege 5116 taskmgr.exe Token: SeCreateGlobalPrivilege 5116 taskmgr.exe Token: 33 5116 taskmgr.exe Token: SeIncBasePriorityPrivilege 5116 taskmgr.exe - Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\example_win32_directx11.dll,#11⤵PID:2204
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5116