Analysis
- user interaction
yes - max time kernel
71s - max time network
63s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VRChatDLSS5Cam.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
VRChatDLSS5Cam.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target VRChatDLSS5Cam.exe
- Size 3.0MB
- Sample260930-e2nzzasshs
- SHA256 eafbfc74c2deda45957c94faa49b8a957a3925c27c38121ea4934a8b9f1350d9
- MD5 7a94e84bad10d12d64ccd5ea9301142b
- SHA1 f243199c8bd57676c1723dbd2a79fdcefcf29dac
- SHA512 5b781d9410b74e1f7b22fdfb63d9a30022a236540c2c4e12b89e6009f0e53122df137fa6db9ebe9740f905a92760a72c7f0191409bd8a2ffff86f0c57960528f
- SSDEEP 49152:Dq98eH6pKYMfeeSkvPCHVJ8qn6+ypvqRwAU7U5WpxJAxCLXezekh/aHnS:G6pKYMFFSHzngEw6
- TLSH T1A7E5AF67A2A500FCD0B7E0B4DE5A6903E632384903316BEF13D499652F376E45A7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4712 VRChatDLSS5Cam.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5520 taskmgr.exe Token: SeSystemProfilePrivilege 5520 taskmgr.exe Token: SeCreateGlobalPrivilege 5520 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe 5520 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4712 VRChatDLSS5Cam.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VRChatDLSS5Cam.exe"C:\Users\Admin\AppData\Local\Temp\VRChatDLSS5Cam.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4712
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5520
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3988
-
C:\Windows\System32\cwa2xz.exe"C:\Windows\System32\cwa2xz.exe"1⤵PID:416