d98e929adc6dea5d76b64b956d02dc7a6563f03a0e09f0e7e6c164045ad3a02b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
version.dll
Size 103KB
Sample261027-mx2dhadt6l
SHA256 d98e929adc6dea5d76b64b956d02dc7a6563f03a0e09f0e7e6c164045ad3a02b
MD5 99d65e11667d108e4482bfd0fe153156
SHA1 654aa6116b7f6272079c3893687a083c27e0eedc
SHA512 44efbb5d4c2143dfa6db1dd0ae9c4ecd78a6c983b5eeec0b01e635fa7c753931ad976335a725f06790811c4d9a010b4950477d7a0bd1a90da78d77f17da64677
SSDEEP 3072:ywte5xrBGJTsmCWW2vv0vkqbpqps7FhNkr25AcokBVbPFxEIOiHTC3iIMw:yD5xVG1Wl230cqkdV
TLSH
T16FA34A5B62E600BBE17A9278C4A70E05D772BC4507A0AFEF43A0065A6F277D14D39F72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	res.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	res.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	res.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	res.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	3352	res.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 3352	4216	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\bin\res.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\res.exe"
  2⤵
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3352-0-0x0000021F9FBE0000-0x0000021F9FBE1000-memory.dmp

Download

memory/3352-1-0x0000021F9FBE0000-0x0000021F9FBE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads