Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 17:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd.dll
- Size 814KB
- Sample260930-v5fe1a1scv
- SHA256 5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd
- MD5 5e389089d5dcfbc57db12643dbc40bd8
- SHA1 08718681b6980a03e723b6e987ab972292ac100d
- SHA512 33428047f8f407b1360868c9130c38a00876e528ebd3a863c6406b1f326d61883e45fe626bfb64ff3d3648e91417891f8b75e52f4f4be625ffc74b8d4524b37e
- SSDEEP 12288:0rSj/2p/3XzpqTf4kuonRUFwKNvEdQu1raNM7IZZ:0rSj/2p/3Xz7k9nEl1wQu1M
- TLSH T162055D29D7594378D0369176EE420C00D73278091794DFEB66805DF27E9BB98AE3FB82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3392 set thread context of 2908 3392 regsvr32.exe 90 PID 3392 set thread context of 1912 3392 regsvr32.exe 91 - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3392 regsvr32.exe 3392 regsvr32.exe 3392 regsvr32.exe 3392 regsvr32.exe 3392 regsvr32.exe 3392 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3392 regsvr32.exe Token: SeTakeOwnershipPrivilege 3392 regsvr32.exe Token: SeRestorePrivilege 3392 regsvr32.exe Token: SeBackupPrivilege 3392 regsvr32.exe Token: SeImpersonatePrivilege 3392 regsvr32.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3392 wrote to memory of 2908 3392 regsvr32.exe 90 PID 3392 wrote to memory of 2908 3392 regsvr32.exe 90 PID 3392 wrote to memory of 2908 3392 regsvr32.exe 90 PID 3392 wrote to memory of 2908 3392 regsvr32.exe 90 PID 3392 wrote to memory of 2908 3392 regsvr32.exe 90 PID 3392 wrote to memory of 2908 3392 regsvr32.exe 90 PID 3392 wrote to memory of 2908 3392 regsvr32.exe 90 PID 3392 wrote to memory of 2908 3392 regsvr32.exe 90 PID 3392 wrote to memory of 2908 3392 regsvr32.exe 90 PID 3392 wrote to memory of 1912 3392 regsvr32.exe 91 PID 3392 wrote to memory of 1912 3392 regsvr32.exe 91 PID 3392 wrote to memory of 1912 3392 regsvr32.exe 91 PID 3392 wrote to memory of 1912 3392 regsvr32.exe 91 PID 3392 wrote to memory of 1912 3392 regsvr32.exe 91 PID 3392 wrote to memory of 1912 3392 regsvr32.exe 91 PID 3392 wrote to memory of 1912 3392 regsvr32.exe 91 PID 3392 wrote to memory of 1912 3392 regsvr32.exe 91 PID 3392 wrote to memory of 1912 3392 regsvr32.exe 91
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd.dll1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\system32\where.exe"C:\Windows\system32\where.exe"2⤵PID:2908
-
-
C:\Windows\system32\whoami.exe"C:\Windows\system32\whoami.exe"2⤵PID:1912
-