Analysis Overview
SHA256
4b3d95dc80a1203c48bcbd2089d57eeaf3a000c42132c2dbb8bda2c5a066f9c9
Threat Level: Known bad
The file 4b3d95dc80a1203c48bcbd2089d57eeaf3a000c42132c2dbb8bda2c5a066f9c9 was found to be: Known bad.
Malicious Activity Summary
Blackguard family
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-11-21 01:25
Signatures
Blackguard family
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-21 01:25
Reported
2024-11-21 01:28
Platform
win7-20240903-en
Max time kernel
122s
Max time network
122s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b3d95dc80a1203c48bcbd2089d57eeaf3a000c42132c2dbb8bda2c5a066f9c9.dll,#1
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-21 01:25
Reported
2024-11-21 01:28
Platform
win10v2004-20241007-en
Max time kernel
94s
Max time network
141s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b3d95dc80a1203c48bcbd2089d57eeaf3a000c42132c2dbb8bda2c5a066f9c9.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 96.136.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |