1351e53fb7c9ecad3fd9a2b608fa0f2c28c43f9896110d9e9410c407c8acf1c2

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pcstory-V6.4.2.0/pcstory-V6.4.2.0/storyservice/fp2papi.dll
Size 218KB
Sample260930-s22sqaycrd
SHA256 1351e53fb7c9ecad3fd9a2b608fa0f2c28c43f9896110d9e9410c407c8acf1c2
MD5 115fc09ba5ce7955cd184ddb7ec95a57
SHA1 b2eda37beedb9bf29dae98e66f7b20798f05ed42
SHA512 1d39f5dca031cece19d4f93e490bcc69dfa2eab69c80b075daf45f07ebe423a724160604a8c883a27a4bee6f92262c1757c8838594a052792b8878d8b8fe6d96
SSDEEP 3072:hwt26+3yELegk91x/ZUJDWmui55GgDiO4yCXX4XQFpq57hoTZ:hb6ghFO1x/ZyqjY3SN4toT
TLSH
T19F249D5573E40CBAED77823A89974606EB727C020770DBEF03A04669AF2B7E1553E760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2956	cmd.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4764	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2956	4764	rundll32.exe	87
PID 2956 wrote to memory of 1820	2956	cmd.exe	89
PID 1820 wrote to memory of 4904	1820	net.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\fp2papi.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop fp2psrv
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\system32\net.exe
    net stop fp2psrv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop fp2psrv
      4⤵
      PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

peers.ini

Path C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\appdata\conf\peers.ini
Size 42B
SHA256 f7f48f9b664b6fb3707e5fbea122892de555010c5ef97ce0b30568b40557e64c
MD5 592302d5137a6c7f6a4951a28365f867
SHA1 9b2b8bdd56f1c6a3f2b0c07098092bde0957c6d8
SHA512 a23c66fc2a5a81c7fa0a5148909e47f1a7f71583afce3feb1d12d7bef635cfbc0a06054c9dc70b30c35cbd3cbab5e91921107da96c133a8d477a073d73d7f7e9
MD5 SHA1 SHA512

Submit Download