1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
endpointdlp.dll
Size 53KB
Sample260428-scdplaex7p
SHA256 1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984
MD5 b148626849c11dd5b3230632a38a6302
SHA1 e5c4e634b2f443f783cae1b5e8247a1069df0c9f
SHA512 18542214f29a7d70e39d204746fafa28ba3cd65afd15e4d04a1f21120fd8ebcc8fb7fa478925c00e86d40947c3c8ba68829481ae6ee00b29eedf5ab3ef4b2cbf
SSDEEP 1536:P0+2AGtCUy8rGThQxoF03RtMpfeRypyt6Yex:P0+2AGtQ8Pxoi2pxpqQx
TLSH
T126337D0328A24766C49384B4C59B7CBB85563D471B3816BB1BF13C583EB62E1CB77A71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	768	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
768	rundll32.exe
2308	powershell.exe
2308	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4372	768	rundll32.exe	80
PID 4372 wrote to memory of 1816	4372	cmd.exe	82
PID 4372 wrote to memory of 1840	4372	cmd.exe	83
PID 768 wrote to memory of 2724	768	rundll32.exe	87
PID 2724 wrote to memory of 2756	2724	cmd.exe	89
PID 2724 wrote to memory of 1380	2724	cmd.exe	90
PID 2308 wrote to memory of 3824	2308	powershell.exe	91
PID 768 wrote to memory of 1048	768	rundll32.exe	92
PID 1048 wrote to memory of 1460	1048	cmd.exe	94
PID 1048 wrote to memory of 4316	1048	cmd.exe	95
PID 768 wrote to memory of 2616	768	rundll32.exe	96
PID 2616 wrote to memory of 3920	2616	cmd.exe	98
PID 2616 wrote to memory of 4532	2616	cmd.exe	99
PID 2308 wrote to memory of 2792	2308	powershell.exe	100
PID 2792 wrote to memory of 780	2792	cmd.exe	101

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\endpointdlp.dll,#1
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg query "HKCU\Software\Microsoft\IdentityCRL\UserExtendedProperties" 2>nul & whoami /upn 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\IdentityCRL\UserExtendedProperties"
    3⤵
    PID:1816
- - C:\Windows\system32\whoami.exe
    whoami /upn
    3⤵
    PID:1840
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg query "HKCU\Software\Microsoft\IdentityCRL\UserExtendedProperties" 2>nul & whoami /upn 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\IdentityCRL\UserExtendedProperties"
    3⤵
    PID:2756
- - C:\Windows\system32\whoami.exe
    whoami /upn
    3⤵
    PID:1380
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg query "HKCU\Software\Microsoft\IdentityCRL\UserExtendedProperties" 2>nul & whoami /upn 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\IdentityCRL\UserExtendedProperties"
    3⤵
    PID:1460
- - C:\Windows\system32\whoami.exe
    whoami /upn
    3⤵
    PID:4316
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg query "HKCU\Software\Microsoft\IdentityCRL\UserExtendedProperties" 2>nul & whoami /upn 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\IdentityCRL\UserExtendedProperties"
    3⤵
    PID:3920
- - C:\Windows\system32\whoami.exe
    whoami /upn
    3⤵
    PID:4532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\system32\tar.exe
  "C:\Windows\system32\tar.exe" xf t.tar
  2⤵
  PID:3824
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\rundll32.exe
    rundll32 endpointdlp.dll,#1
    3⤵
    PID:780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_r0vche0o.fl2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r0vche0o.fl2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/768-0-0x000002233E5A0000-0x000002233E6F0000-memory.dmp

Download

memory/768-7-0x00007FF96B410000-0x00007FF96B42C000-memory.dmp

Download

memory/768-6-0x000002233E490000-0x000002233E491000-memory.dmp

Download

memory/768-9-0x000002233CAA0000-0x000002233CAD1000-memory.dmp

Download

memory/780-56-0x0000016211600000-0x0000016211631000-memory.dmp

Download

memory/1380-24-0x00000209339F0000-0x0000020933A21000-memory.dmp

Download

memory/1840-8-0x0000013E239C0000-0x0000013E239F1000-memory.dmp

Download

memory/2308-20-0x0000015BF4AF0000-0x0000015BF4B36000-memory.dmp

Download

memory/2308-13-0x0000015BF45A0000-0x0000015BF45C2000-memory.dmp

Download

memory/2308-26-0x0000015BDA550000-0x0000015BDA581000-memory.dmp

Download

memory/2308-27-0x0000015BF4450000-0x0000015BF445C000-memory.dmp

Download

memory/2308-28-0x0000015BF44D0000-0x0000015BF44E2000-memory.dmp

Download

memory/3056-10-0x0000026CE3DB0000-0x0000026CE3DE1000-memory.dmp

Download

memory/4316-39-0x0000015750C30000-0x0000015750C61000-memory.dmp

Download

memory/4532-50-0x0000020C52660000-0x0000020C52691000-memory.dmp

Download