7fb9981c58663f7687e5404369cd5434ce7e043c1b805cc8512961d2fc5f1cf8

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dwm.exe
Size 132KB
Sample261026-t5mnmsfs41
SHA256 7fb9981c58663f7687e5404369cd5434ce7e043c1b805cc8512961d2fc5f1cf8
MD5 a9c244b06a6521b27573d3eae853d0ed
SHA1 fb319a20e1e192ccac3df481c5b1021c2babb78b
SHA512 263c8c945bf88da33cc40acafb29f0a511dd266968b8a5d8f8e9514e122e904b432014fee2786051eb76a887eb94880327984bb3663d81748e960607a96ba821
SSDEEP 3072:Jr0u3lvS9hnnd9LfbF0jp8lVD4kJBX/QXay:WmvS7nnvLfbx94wX/QXa
TLSH
T183D35B1D37E910E5E57A917CC592460DE7B2B82157119BDF03A042BD4F23FE86C39BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\dwm.exe	dwm.exe

C:\Users\Admin\AppData\Local\Temp\dwm.exe
"C:\Users\Admin\AppData\Local\Temp\dwm.exe"
1⤵
- Executes a file named after a Windows system binary
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads