58ffd4f320f011b9b70a9555cd0c22ec7b244795b2d4900c31837cc7716f44f3

Analysis

user interaction
yes
max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.exe
Size 5.3MB
Sample261107-v5tbvszyav
SHA256 58ffd4f320f011b9b70a9555cd0c22ec7b244795b2d4900c31837cc7716f44f3
MD5 c313318d53dd6e977a254c194a43ab2f
SHA1 20508c4e849ea78f724f4e18411d99b44ee5e98a
SHA512 e24bb9c9ce98695f154042bd0a3056632c77edea169a2b53fe6d5f8df9fd47d7a974b9008cefafde50875f86c276059a3c666d44b81ed9e2b991ede1a9fc62ff
SSDEEP 98304:I2aSrywGhezKSZ/AZ5ysB2uPc7brbMDKihV4NZAAANkXBHtsbG30ByZA13NgnM:oSGdhQKIeFB2JyK+OsAANkdfk1i
TLSH
T17446331527A456FCE5AB63B88CB65A72B76774140370A6EF076428342F335E08E33F69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2040	script.exe
2040	script.exe
2040	script.exe
2040	script.exe
2040	script.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	script.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2040	2420	script.exe	89

C:\Users\Admin\AppData\Local\Temp\script.exe
"C:\Users\Admin\AppData\Local\Temp\script.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\script.exe
  C:\Users\Admin\AppData\Local\Temp\script.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2420_615005_ga_AbiU2uh8\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2420_615005_ga_AbiU2uh8\_cffi_backend.pyd
Size 177KB
SHA256 9af5e4f68a41f26b726f2e9424f9d58a4f5666189f6a48be95f406b257102aec
MD5 507d7acaac822c99f2f574d354af43b0
SHA1 bbe267010c80e0988937d0cb35852081dcbd3395
SHA512 a2236f07849144bf6842c3a48f5d816944d5505168b11edf1803ac05140c1de9af8321777e94dac0babbd26a315d902bfe5e297b1ee56c69230c7314c4fb8136
SSDEEP 3072:knXfJh2GStDfSNvGh+8JYCJ/QXIlv6g6g0h3Vcv2dxQsGsdwofbP7clSTL7Ku3AS:knxvGhD0uv6g6g05Vcv2JGqHfbAlSTLt
TLSH
T19E046C5A329C11B6D5A2517886579B43E3B3B421170197CF01B0C7B62F1BBEA7A7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2420_615005_ga_AbiU2uh8\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raylib_cffi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2420_615005_ga_AbiU2uh8\raylib\_raylib_cffi.pyd
Size 2.3MB
SHA256 798f95952b973776627d15f73b5d030b881395e5d2caa2d47c18a32100e5b74a
MD5 638a6b105153b584b171633302a429ed
SHA1 9ca92a3822e0b523145f192222bef1ab8d35e610
SHA512 879f10fedfd841e8873a010e1dd244e1ecbc7e8ea7883def6b22d0c5f77b140aefb79a9b8141659f6b53e9d08f53146f7e2d6aaf3a496ff4a0230b008f8000e4
SSDEEP 24576:1RUgZ35ok8j3OPao/XdviuYbEsOUud64Oj0Yehc4njrr7e/WcmWEprByJQGCkyTx:f3578iPaofK4n/r7DcMp0hyT4huku4
TLSH
T187B59E46F2A6A0D8C92BD439D697F20BE3723409178464DB72C09A982F77FD2137EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

script.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2420_615005_ga_AbiU2uh8\script.dll
Size 6.4MB
SHA256 037d55743fe4a186fa0c538091719b0ec7c2b09564fc0234f2cab23d84e0fda0
MD5 cea0523019894ad0403ad9cab3fb109f
SHA1 8212e0546bc9fcbec9f20f212c6fd85923c4325b
SHA512 f4629d074cf37e3ed2ce99e6e6cda7f92f9ce4858a2de72eba8d5ec747fcecb7b472a0ca80a45c421642e1ee8358cbaa0bc3028971113aa50108e681a7127919
SSDEEP 98304:HwmyxSKkEWD1FTq17UpJwIX4uzWObPPQnxs1E:HNrEWD1WeE
TLSH
T192664A8277A1D073FDA1F1F64816065AF771A4B67711939330AFC1A92F4BAE09EA44CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads