Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
27/04/2026, 12:33
General
- Target 717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a.dll
- Size 99KB
- Sample260427-pre97abs6t
- SHA256 717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\client'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'Utility.dll'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a.dll'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Utility.dll'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_h0la2v1p.wuh.ps1
memory/516-77-0x0000000005D70000-0x00000000060C4000-memory.dmp
memory/516-89-0x0000000004B80000-0x0000000004BA4000-memory.dmp
memory/516-79-0x00000000700D0000-0x000000007011C000-memory.dmp
memory/516-90-0x0000000004F20000-0x0000000004F38000-memory.dmp
memory/516-88-0x00000000055F0000-0x0000000005BF8000-memory.dmp
memory/1040-68-0x00000000060F0000-0x0000000006114000-memory.dmp
memory/1040-67-0x0000000006230000-0x0000000006838000-memory.dmp
memory/1040-48-0x00000000033E0000-0x00000000033F0000-memory.dmp
memory/1040-69-0x0000000006190000-0x00000000061A8000-memory.dmp
memory/1040-58-0x00000000700D0000-0x000000007011C000-memory.dmp
memory/1040-56-0x00000000069A0000-0x0000000006CF4000-memory.dmp
memory/1040-47-0x00000000033E0000-0x00000000033F0000-memory.dmp
memory/4368-0-0x0000000074C51000-0x0000000074C52000-memory.dmp
memory/4368-112-0x00000000008F0000-0x000000000092B000-memory.dmp
memory/4368-113-0x00000000008F0000-0x000000000092B000-memory.dmp
memory/4532-19-0x0000000006D30000-0x0000000006D62000-memory.dmp
memory/4532-20-0x00000000700D0000-0x000000007011C000-memory.dmp
memory/4532-35-0x0000000007D00000-0x0000000007D96000-memory.dmp
memory/4532-36-0x0000000007C80000-0x0000000007C91000-memory.dmp
memory/4532-37-0x0000000007CB0000-0x0000000007CBE000-memory.dmp
memory/4532-38-0x0000000007CC0000-0x0000000007CD4000-memory.dmp
memory/4532-39-0x0000000007DC0000-0x0000000007DDA000-memory.dmp
memory/4532-40-0x0000000007DA0000-0x0000000007DA8000-memory.dmp
memory/4532-45-0x0000000006060000-0x0000000006078000-memory.dmp
memory/4532-43-0x0000000005910000-0x0000000005F18000-memory.dmp
memory/4532-44-0x00000000050D0000-0x00000000050F4000-memory.dmp
memory/4532-33-0x0000000007A80000-0x0000000007A9A000-memory.dmp
memory/4532-32-0x00000000080C0000-0x000000000873A000-memory.dmp
memory/4532-31-0x0000000007950000-0x00000000079F3000-memory.dmp
memory/4532-30-0x0000000007930000-0x000000000794E000-memory.dmp
memory/4532-21-0x00000000011F0000-0x0000000001200000-memory.dmp
memory/4532-22-0x00000000011F0000-0x0000000001200000-memory.dmp
memory/4532-34-0x0000000007AF0000-0x0000000007AFA000-memory.dmp
memory/4532-18-0x000000007FCF0000-0x000000007FD00000-memory.dmp
memory/4532-17-0x0000000006790000-0x00000000067DC000-memory.dmp
memory/4532-16-0x0000000006760000-0x000000000677E000-memory.dmp
memory/4532-15-0x0000000006170000-0x00000000064C4000-memory.dmp
memory/4532-6-0x0000000006090000-0x00000000060F6000-memory.dmp
memory/4532-7-0x0000000006100000-0x0000000006166000-memory.dmp
memory/4532-5-0x0000000005280000-0x00000000052A2000-memory.dmp
memory/4532-4-0x00000000052E0000-0x0000000005908000-memory.dmp
memory/4532-1-0x00000000011F0000-0x0000000001200000-memory.dmp
memory/4532-3-0x00000000011F0000-0x0000000001200000-memory.dmp
memory/4532-2-0x0000000002B70000-0x0000000002BA6000-memory.dmp
memory/5780-109-0x0000000005950000-0x0000000005F58000-memory.dmp
memory/5780-111-0x0000000006040000-0x0000000006058000-memory.dmp
memory/5780-110-0x00000000050D0000-0x00000000050F4000-memory.dmp
memory/5780-100-0x00000000700D0000-0x000000007011C000-memory.dmp
memory/5780-98-0x0000000006150000-0x00000000064A4000-memory.dmp