Analysis
- max time kernel
180s - max time network
182s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
28/04/2026, 01:58
General
- Target a1e5e02b53406770ca90751878df57c1a2b6cccc6c6f0ae1e3f51381477e3d49.dll
- Size 5.0MB
- Sample260428-cdz18acw21
- SHA256 a1e5e02b53406770ca90751878df57c1a2b6cccc6c6f0ae1e3f51381477e3d49
Malware Config
Signatures
- Family: Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (4193) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e5e02b53406770ca90751878df57c1a2b6cccc6c6f0ae1e3f51381477e3d49.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e5e02b53406770ca90751878df57c1a2b6cccc6c6f0ae1e3f51381477e3d49.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
mssecsvc.exe
tasksche.exe
memory/1032-20-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-22-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-11-0x0000000001A10000-0x0000000001A17000-memory.dmp
memory/1032-10-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-12-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-14-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-16-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-18-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-42-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-40-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-24-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-26-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-28-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-30-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-32-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-34-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-36-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/1032-38-0x0000000001390000-0x00000000014A2000-memory.dmp
memory/4400-8-0x0000000001360000-0x0000000001472000-memory.dmp
memory/4400-9-0x00000000033D0000-0x00000000033D7000-memory.dmp