1351e53fb7c9ecad3fd9a2b608fa0f2c28c43f9896110d9e9410c407c8acf1c2

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pcstory-V6.4.2.0/pcstory-V6.4.2.0/storyservice/fp2papi.dll
Size 218KB
Sample260930-s22sqaycrd
SHA256 1351e53fb7c9ecad3fd9a2b608fa0f2c28c43f9896110d9e9410c407c8acf1c2
MD5 115fc09ba5ce7955cd184ddb7ec95a57
SHA1 b2eda37beedb9bf29dae98e66f7b20798f05ed42
SHA512 1d39f5dca031cece19d4f93e490bcc69dfa2eab69c80b075daf45f07ebe423a724160604a8c883a27a4bee6f92262c1757c8838594a052792b8878d8b8fe6d96
SSDEEP 3072:hwt26+3yELegk91x/ZUJDWmui55GgDiO4yCXX4XQFpq57hoTZ:hb6ghFO1x/ZyqjY3SN4toT
TLSH
T19F249D5573E40CBAED77823A89974606EB727C020770DBEF03A04669AF2B7E1553E760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5964	cmd.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4908	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 5964	4908	rundll32.exe	90
PID 5964 wrote to memory of 2136	5964	cmd.exe	92
PID 2136 wrote to memory of 1960	2136	net.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\fp2papi.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop fp2psrv
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Windows\system32\net.exe
    net stop fp2psrv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop fp2psrv
      4⤵
      PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads