520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe
Size 67KB
Sample260919-vner5stdrc
SHA256 520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d
MD5 33997e4dc5ed6e790fed69eaf0733691
SHA1 dd1e3338a795d143e6baf8248581073f412337f6
SHA512 790ac0b85baef49a5c2995cfbf0fd902f0ffa500c852975db67f3cc838cd622a75a3d28bc92175d27ef03664f9123e44af7c88c2672fcce0e4899a66d04d88b8
SSDEEP 1536:52mgyYE4gnKNs1NfwKElrwgMW5shlIIOB+4OECYiCry4KyCiwUjFT:xYgKW1NfwK6sX/9ECYrFV
TLSH
T159632A0973E8456BE6BF4BB5887629044373B5AB5C16F7CC0CC7909D096ABE0CA14BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 1960	3828	520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe	89
PID 3828 wrote to memory of 8	3828	520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe	91
PID 3828 wrote to memory of 4596	3828	520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe	93
PID 3828 wrote to memory of 3800	3828	520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe	95
PID 3828 wrote to memory of 1864	3828	520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe	97
PID 3828 wrote to memory of 2084	3828	520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe	99
PID 3828 wrote to memory of 1440	3828	520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe
"C:\Users\Admin\AppData\Local\Temp\520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\WindowsUpdate\Scheduled Start"
  2⤵
  PID:1960
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\WindowsUpdate\Scheduled Start"
  2⤵
  PID:8
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"
  2⤵
  PID:4596
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /xml ONE
  2⤵
  PID:3800
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task"
  2⤵
  PID:1864
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /xml ONE
  2⤵
  PID:2084
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\UpdateOrchestrator\UUS Failover Task"
  2⤵
  PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3828-0-0x0000000000E20000-0x0000000000E36000-memory.dmp

Download

memory/3828-1-0x000000001C230000-0x000000001C240000-memory.dmp

Download

memory/3828-2-0x000000001C230000-0x000000001C240000-memory.dmp

Download

memory/3828-18-0x000000001C230000-0x000000001C240000-memory.dmp

Download

memory/3828-19-0x000000001C230000-0x000000001C240000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads