Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 16:49
Behavioral task
behavioral1
Sample
tspu-monitor-2.2.4-windows-x64.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
tspu-monitor-2.2.4-windows-x64.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target tspu-monitor-2.2.4-windows-x64.exe
- Size 11.0MB
- Sample261027-vb7bmats4l
- SHA256 951dd4ba34f98dd0c37361695cd574eeae0e331d14bf0098daab4f89ffb7c3a7
- MD5 faf205af11430e7dd459ae54e3a9c030
- SHA1 091b6997ab24e2362f467aebbd86d17b99851f2d
- SHA512 e172561fc240bf6e765f0c60079178e81fcd1d2eaba1eefd61fa696c6871465edf9ef2dcb95786f2d8a42bfc7bfb862e28cc0810430eb4aa19e4d500e7682327
- SSDEEP 196608:CtBW2eBRNTwhLIdurHmEeuhHToAUPNfGU5vXvLk0ax8lLZDdeUHFxZ+820H:A9LIduCMhHTodRGkXJaxItDQU3A8
- TLSH T140C633A9E3E149F8FDE7D7388912912893763C510361C1DB02E48AA37E375F43A39766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 21 IoCs
pid Process 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe 5720 tspu-monitor-2.2.4-windows-x64.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4624 wrote to memory of 5720 4624 tspu-monitor-2.2.4-windows-x64.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\tspu-monitor-2.2.4-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\tspu-monitor-2.2.4-windows-x64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\tspu-monitor-2.2.4-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\tspu-monitor-2.2.4-windows-x64.exe"2⤵
- Loads dropped DLL
PID:5720
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_asyncio.pyd
- Size 72KB
- SHA256 c77de90cad749087a0c5dc5e19d78d24f6ef44e7e5ac19b8420cfc0cea62395d
- MD5 0ad3abc085f1d954eff9dfa83039ebb7
- SHA1 edb66b8223c3897a72b171f221934a4fee9dc24e
- SHA512 76bbe6a89a11a946e4901a8321c3b9f02cbd6a36dfb42dfdf5be00ae78cf5b699d74bd2f1af0c6f0b0c12fc91d1f400e5eb80ed7792f4bea8c6aee212d368d15
- SSDEEP 1536:cFOnRUrojeb8eUAN8bvobyjBIWOnsytH/9qUfIZR6/:cserQege3N8bvFBIWOn8Zw
- TLSH T1F6738DC6A2A4418BDD93B274C5636F93FBB0F6421501475F61A8C28E2F6379183FE726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_bz2.pyd
- Size 84KB
- SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
- MD5 2be172c3086efe56c7e1d3279142295a
- SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
- SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
- SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
- TLSH T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_ctypes.pyd
- Size 124KB
- SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
- MD5 9314ab9707985aaf6e234b5c1fc3c3c6
- SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
- SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
- SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
- TLSH T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_decimal.pyd
- Size 255KB
- SHA256 aeacfead2befcc0768063a037bb64bd32109ae09cb144e5f571b04dd7965db9d
- MD5 240a03069d6968741b703d026337ad2c
- SHA1 42e6298c697e48d062db8835bafb976ef76b1f73
- SHA512 60b99cd5f1c66514fcd674f3400dabe84f4cff55a0d5ff5959879d226f3dbe85d325630a4a5583e54e8af313216fb3288d9a466d285973078675677dd6470117
- SSDEEP 6144:MsO6Ms4BvOcJ3TXFIZK1qGh9qWM53pLW1A8A/ctJuHI:4BvOcJ3BIZ/Gk6A/kJuH
- TLSH T105446B56A2490DA4EE738074889BDA57FBB278960320D78F43B48A973F577A3137D348
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_lzma.pyd
- Size 157KB
- SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
- MD5 7c25a079b992919cc97221955dac050c
- SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
- SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
- SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
- TLSH T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_overlapped.pyd
- Size 55KB
- SHA256 662126ff80c3a1b4cedf74074029c12ae4743e6d3b37376e39ac70aacb7d4d3c
- MD5 a7fa2fbc0ae8c41a1911aed0703d37b7
- SHA1 8f88ad4e9b152844867584d91e9883ff38444286
- SHA512 aa99635e398092c2375e6fb4f0c4fefe1a376e564a9b2cee48a8840b2208b306314d53134ae9384033d899070a994107ed8809d5c8206c8517d518efe3b7d33c
- SSDEEP 1536:V+rYIgKZPXjCJP+s1wIDmdIWXtnytH/9XfIik:tJP+s1wIDmdIWXtxz
- TLSH T162438D0A679400DAEE73D279D1678E07FB74B2D35610A31F60A8D68E1F73792A71E384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_queue.pyd
- Size 32KB
- SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
- MD5 6ffc75670dfed859cc7ca266bcc89816
- SHA1 5a39c3fd8fb398234611b91a5da260547442da52
- SHA512 d26d74232dce6c6e57c92a0cfae605bbef7036dd848a04ca8b267aeee1aa12b1b06813746466ce186c363b3c89034424ee64681399b8d00f4d4e997abfef475b
- SSDEEP 768:eVzlP6rT1wyzklIWQUFOytxJEKrLy2Ip44Cxf1mljr8VMSU:eTST1lzklIWQU4ytH/9pfI38VMJ
- TLSH T164E29FCAAE644047E563CA70C2E7EE93F935B7935601879F2065C18E1F237C1E726329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_socket.pyd
- Size 83KB
- SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
- MD5 0106ee3f61a54d922190b3a01c81a453
- SHA1 420bd90297b2df30f00813e4ee17177fa0c77c3b
- SHA512 393bb603efa2f1fb783f2a9b898911af0882ff5919c2b3cf615845a349662b7b64d276398187b11f2c5c07a022459dd8d8b41c0ce331bc31c5f088056da7083c
- SSDEEP 1536:BdcydNg46ARGrwISALqwXV9/s+S+pzgMX49IEuDQ6JnlIWLwhmytH/9hjCfIbp:B6ydCA0c6qwXV9/sT+pzgV9IbDTJnlIR
- TLSH T193835A10A6A051FAEB63D075C2639F63FBB4B6C12395935F1092C65E1F33782AE39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_ssl.pyd
- Size 175KB
- SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
- MD5 ed9242721197fd84231b38e6b42f3f55
- SHA1 4333b9d43a120a6528f63cdba798c8153e8bfdfa
- SHA512 9b4b94f6bf927c07e2e63bc6ee6140ec090c3063dee920d609dc49cb5ce30653ca2e32f4d6f700969082b79b836a276aa1c2fb17cf53f02c2d4f207a1f0d3552
- SSDEEP 3072:l+59j9Gd6wNsBjj903ff6X32RP0o/aC6osf87vOifHZHmziXpIWC7Cz:l+v9Gd6BtGPf6X3fUaC+2Xp
- TLSH T1F2048D47B5841AB7D813E4F9C2234903DBB1F155331257DE48D6E6890F03B4AAEBAB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_uuid.pyd
- Size 26KB
- SHA256 acce4f281d7ffb2dec0997527faf25b1df62ad7bd3032c568ddcf65c90edc867
- MD5 3a531588286a202a51d21773533cdd2b
- SHA1 872ad46fcea03bded5c2647e7ae1365fd4533271
- SHA512 1616a748e4dc9112b20bba1054f779b4d0babf0c9f86f9fc264078dbba479cf4ddc1d1403c69a760d704da37045199ff35a2a90b6e25bde7cae70ecffeafa3ff
- SSDEEP 768:tIjeWpIWZw7OytxJEKrLy2Ip4jCxf1ml0ZM+:tIjeWpIWZw6ytH/98fIb+
- TLSH T1D8C26B8AAA745007FE53977091F6CE43F979BBD34A11478B31A591860E237C1B31B36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\_wmi.pyd
- Size 39KB
- SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
- MD5 c7427027acbd9a0076b598fc71ee45a5
- SHA1 cc2ab52f295e588f8bc99f23cc25467d7bfd9732
- SHA512 e9ea1748c317b8439425306d44593a1210c552bd28cdbb20df2bf8e18041ea76d1c666e5fd2cc03268d48b5982f01de71136a079f083f4a62cab06d91fd114f4
- SSDEEP 768:iEkKOex+l0WgNQqDpIWCiWOytxJEKrLy2Ip44oTxf1mltPRVQgM:iE9OtyNQqDpIWCiJytH/94UfIZReF
- TLSH T1DB037D89E6A80046EA63DBB5C9A6CE53F471B7D35B11D38F365582990F233C0E739329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\base_library.zip
- Size 1.3MB
- SHA256 042047bcf80d54e790fd01b658614f099dfd72302f5e28418e467f7432224288
- MD5 941d5353bc6a44dfe241c3426f35c242
- SHA1 efef1b346c7435b911c6a528bae4c06c065e2dce
- SHA512 484542c64c65fc03c0d14c9a05cb1c02e36989b54d0519f3b5ac103bbba7366bdf713cce632a48fe95903373dcecf7053a60d7829c8502cdebe034f05ce8b143
- SSDEEP 12288:o/shR9HbP1dmX8lJGUm0rmn9V3INI9Wd2/HnNwnVTVihlyixmpvQXMHYiE:oADbP1dmX8lJGU969F9G2/HehJE
- TLSH T16955D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\libcrypto-3.dll
- Size 5.0MB
- SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
- MD5 ae5b2e9a3410839b31938f24b6fc5cd8
- SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
- SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
- SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
- TLSH T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\libssl-3.dll
- Size 776KB
- SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
- MD5 8d4805f0651186046c48d3e2356623db
- SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
- SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
- SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
- TLSH T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\python312.dll
- Size 6.6MB
- SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
- MD5 de50496cece613ec7ebedbf9f2aefecd
- SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
- SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
- SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
- TLSH T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\select.pyd
- Size 32KB
- SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
- MD5 74b93bc6c37d47011f92024f060c6784
- SHA1 0e9cd2e881ad58818fc75b1fda765841995a92dd
- SHA512 7c92a9c3d676ebf5211b93c7e44cbc77e17925d2ccaba97aa9b52d3fb4050e746ea4a86e82f9553717ddeffade3aaf518563a442578899bc05d65cac57031b58
- SSDEEP 768:gFOLHfEDnlIWQGiOytxJEKrLy2Ip4MTxf1mltPRVugwH:gFOL/EDnlIWQG9ytH/9gfIZRsXH
- TLSH T146E27D8AAB245087F963CA7186A2CE43F939B7E3471146CF30A5D2991E237C1B73A355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000012102\yaml\_yaml.cp312-win_amd64.pyd
- Size 248KB
- SHA256 4fd0e84f50261ed0886cffcdd8008b055af3352546e649c3d741b50eae1f9b5f
- MD5 d731f7a851c0a4dc1dec15a9dbd551a8
- SHA1 5e9b1a12453490d76e5813a660920629a0e6ed3c
- SHA512 45fc00767e955f750e620a13f61e1f81c9c9cea32f1a03e4a497d81c6164ada1db329fa514255491a8f4e3c4ee56d48c9af97b2157d98c389c2bfc02eed29213
- SSDEEP 3072:ba6iglacmPPB6irwZo42kmnhdllBAekoZmR5N7brztnmt6J3/sa:b83cmx6OwZlbmnhReemR5N/T3/sa
- TLSH T1DB444B156AA0087AFEA380B84837D917E7F270056720E7DF03B0E6493F17B967ABD255
- MD5 SHA1 SHA512 SSDEEP TLSH