73a95157bef5cfb8dc294e905b8c0d8e750bb7b18ed374e70307b1cdcecf9172

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ck-3d80df5d12cdfe6450a782fc87bf66b444.dll
Size 4.5MB
Sample260420-pnbslaev2v
SHA256 73a95157bef5cfb8dc294e905b8c0d8e750bb7b18ed374e70307b1cdcecf9172
MD5 ed3f564b0730a2b8995f052befa5f12c
SHA1 d736f95c557ed734e060a6535c5ea940c42dc20a
SHA512 b194c03fb2edb556dc1e777fb513c435f76359e5359ec382beeeb4eae13c2376bca0f754af2dea8a2f68190ffc5022718f6e8fb7cd95c3b6fb5e1b41f732f243
SSDEEP 49152:AEZigVGgO6P/9Ar+IP8Q8muFNeGVVQcrhepxtwjcwQcxhWTU:AXp8m98m/b1yWY
TLSH
T18D269F1BBDB95869C09AF1388473A705F565B8451B1227C71AB0F22C2F3B7F05AF9B18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2392 created 3128	2392	rundll32.exe	53

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1580	rundll32.exe
3	1580	rundll32.exe
4	1580	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2392	rundll32.exe
1580	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2392	rundll32.exe
2392	rundll32.exe
1580	rundll32.exe
1580	rundll32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2392	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	rundll32.exe
Token: SeBackupPrivilege	1580	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 3032	2392	rundll32.exe	80
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81
PID 2392 wrote to memory of 1580	2392	rundll32.exe	81

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3128
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ck-3d80df5d12cdfe6450a782fc87bf66b444.dll,#1
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\dllhost.exe
    C:\Windows\SysWOW64\dllhost.exe
    3⤵
    PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\SysWOW64\rundll32.exe
  2⤵
  - Badlisted process makes network request
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-0-0x00000175E4220000-0x00000175E4221000-memory.dmp

Download

memory/2392-2-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-1-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-4-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-5-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-7-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-6-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-3-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-30-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-29-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-28-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-27-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-39-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-38-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-37-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-36-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-35-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-34-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-33-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-32-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-31-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-26-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-25-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-24-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-23-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-22-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-21-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-20-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-19-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-18-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-17-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-16-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-15-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-14-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-13-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-12-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-11-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-10-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-9-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-8-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-40-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-52-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-51-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-50-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-49-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-41-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-48-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-47-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-46-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-45-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-44-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-43-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-42-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-57-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-56-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-55-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-54-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-53-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-63-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-62-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-61-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-60-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-58-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download

memory/2392-59-0x00000175E4310000-0x00000175E4311000-memory.dmp

Download