Overview

overview

7

Static

static

3

gdi.exe

windows10-2004-x64

gdi.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    110s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 16:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    gdi.exe
  • Size 6.9MB
  • Sample261014-tk2l3afv7y
  • SHA256 cc4aef87a4c0c094f20d4d3cbc7d30d608a93fbea26a4115731f6e813b40b94c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\gdi.exe
    "C:\Users\Admin\AppData\Local\Temp\gdi.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3708
    • C:\Users\Admin\AppData\Local\Temp\gdi.exe
      "C:\Users\Admin\AppData\Local\Temp\gdi.exe"
      2⤵
      • Loads dropped DLL
      PID:1164

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\_bz2.pyd
        • Size 71KB
        • SHA256 c46b2979e25b66827d0361a559e12879b8a250cf5c8771a54db94e4808e00685
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\_ctypes.pyd
        • Size 116KB
        • SHA256 c10b0b0f800c1327cb627a342b9afc5960d436e9e08b02f5d6971da69e4722c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\_decimal.pyd
        • Size 237KB
        • SHA256 5566518542e3ee6dd8cbecbae76e40a30015e82cc04ee4ea768a3cc9fb53f4ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\_hashlib.pyd
        • Size 52KB
        • SHA256 5f17438d0e3091e6006048c873ce43e7e33d842a2a736500815a56aa8be4bf01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\_lzma.pyd
        • Size 149KB
        • SHA256 0369454200d4b8deb3959415aae9bb9926e681b14bcb4427e432381fe57ecb27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\_socket.pyd
        • Size 66KB
        • SHA256 9bc8b64506c21e94457da274573e85777a06b67d4d6b98dddeab4b97172fcef1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\base_library.zip
        • Size 1.4MB
        • SHA256 5d7330b8046a385dd5e38ed0098f8669d81fae74cc73a802f8b829ea215f5e03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\libcrypto-3-x64.dll
        • Size 7.6MB
        • SHA256 4ef4f59ddc79f232a76e7eee7a7fd91792974ba885011b00acada8debfc14173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\libffi-8.dll
        • Size 27KB
        • SHA256 d56b5e5aa064e35f9ae5d11d2f0833a591d946bc04b85e1772ddfa7c84eb33a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\python311.dll
        • Size 5.6MB
        • SHA256 06cb189016f6d5a593aba0e4c53ae972f2b7a257373c502e7da80f35f37dc1c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\select.pyd
        • Size 18KB
        • SHA256 ab91970ff8458849e59711e323dc49f09bafe7a650ddcf797fd7242343ebc49d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e7c2\unicodedata.pyd
        • Size 1.1MB
        • SHA256 aa489115a8139de6aa0db51e2c8771c78df430fd7c3c65b714f385833ccc91fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1164-33-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download

        memory/1164-34-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download

        memory/1164-35-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download

        memory/1164-36-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download

        memory/1164-37-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download

        memory/1164-38-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download

        memory/1164-39-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download

        memory/1164-40-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download

        memory/1164-41-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download

        memory/1164-42-0x00000285D0880000-0x00000285D0E63000-memory.dmp
        Download