93c3fc2cf55dedbf9fe9325f7ed62aa39a289d5f83d6ddffdf282a1278b88c0d

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
44s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/09/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CPUIDHWMonitor.exe
Size 18.8MB
Sample260903-c19h6ssyay
SHA256 93c3fc2cf55dedbf9fe9325f7ed62aa39a289d5f83d6ddffdf282a1278b88c0d
MD5 c263a3a82e0ac4a0c38afa6def80669d
SHA1 7f46dd12ec28d245ba4fd578b84e71365077fcff
SHA512 338acbbb4996f14bb14b6a282018f8c6ac7e3e3fe804f7dc48456e6093f59677506a8133f14c20f9333254e9d7eef81b421f89512bb7a07f38f4aebbdfa36885
SSDEEP 393216:HevDtsswizD+ek5yd3ShUuLXSPKdMOd7JiWVKQ2v/1R0pUvt1QkZPk0H:ADOs5zDL/d3Xibd7c+bEzfFLH
TLSH
T11B17D0B8951E18C5FF61EDF985C5679C810D39723F283AA3B01EA300077247A5BE7D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3208	CPUIDHWMonitor.exe
3208	CPUIDHWMonitor.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3208 set thread context of 1104	3208	CPUIDHWMonitor.exe	79

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 1104	3208	CPUIDHWMonitor.exe	79
PID 3208 wrote to memory of 1104	3208	CPUIDHWMonitor.exe	79
PID 3208 wrote to memory of 1104	3208	CPUIDHWMonitor.exe	79
PID 3208 wrote to memory of 1104	3208	CPUIDHWMonitor.exe	79
PID 3208 wrote to memory of 1104	3208	CPUIDHWMonitor.exe	79
PID 3208 wrote to memory of 1104	3208	CPUIDHWMonitor.exe	79
PID 3208 wrote to memory of 1104	3208	CPUIDHWMonitor.exe	79
PID 3208 wrote to memory of 1104	3208	CPUIDHWMonitor.exe	79

C:\Users\Admin\AppData\Local\Temp\CPUIDHWMonitor.exe
"C:\Users\Admin\AppData\Local\Temp\CPUIDHWMonitor.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\CPUIDHWMonitor.exe
  C:\Users\Admin\AppData\Local\Temp\CPUIDHWMonitor.exe
  2⤵
  PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-0-0x0000000140000000-0x000000014013B000-memory.dmp

Download

memory/1104-1-0x0000000140000000-0x000000014013B000-memory.dmp

Download

memory/1104-2-0x0000000140000000-0x000000014013B000-memory.dmp

Download

memory/1104-3-0x0000000140000000-0x000000014013B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads