ae55c1fbcb28dd7619a4b123e797ab6a881eb372ee0a4bbf4e1a3adaf7e0f0fc

Analysis

max time kernel
298s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 00:57

Target
base.dll
Size 3.9MB
Sample260509-bbaswact8k
SHA256 ae55c1fbcb28dd7619a4b123e797ab6a881eb372ee0a4bbf4e1a3adaf7e0f0fc
MD5 7bd881344e617a490488856027f05207
SHA1 71c898bbfbf0229e97ee54301b80de07779b2034
SHA512 991922c22033494f3ba342025ba72853e8f2a417f4a01f9dc7a7c890057193bd3df8fbb02891925d101657d5d81d34dd4b2e60ade1ac203ed12bcf7f0b42ae49
SSDEEP 49152:qHurAOEf+azjeLFxON/Qhek2sI3l0ZZxiD8d3gJkHLBayoWxYHH1uQQsoB:pFIBlYayoWxYHH1uQQsoB
TLSH
T1C5161A12B7B622A1C6FBC7B5D0420937D5F263E4A70503494499E549398AAFC2F6FEF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32.exe	rundll32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32.exe	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 1780	3480	rundll32.exe	80

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 1780	3480	rundll32.exe	80
PID 3480 wrote to memory of 1780	3480	rundll32.exe	80
PID 3480 wrote to memory of 1780	3480	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\base.dll,#1
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780

memory/1780-0-0x0000000000510000-0x0000000000556000-memory.dmp

Download