b5b38be381232481a3b5b59518b3a278d4415b2a18280f0950040db5d21a8d7e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$_54_/13.7.0.41868/Assistant/2345MgrDLL64.dll
Size 2.1MB
Sample260527-3tkvcads61
SHA256 b5b38be381232481a3b5b59518b3a278d4415b2a18280f0950040db5d21a8d7e
MD5 1376ff268e2a998eefd92018da3e32b6
SHA1 8b560bf1c689c07dc43728bc430957e44fc618c2
SHA512 572f381364172811d3be394949becc375eb01c64c6e4417e3c45fb48ce89fceb5cd57d7ed3d48b8d3d3b8740d1d1b91fa1653400bf6a2f02f82aaf11e72ccb37
SSDEEP 49152:44ZxZPsrW2STnzsHI06n7x8qi9IkTOesSJSkSc0KFt0HS2ZY:44Zxekz0IYqi99e+SxKFtk2
TLSH
T1B2A533768DA8BF67E607CC7870757468A943FC2CC34248EBAAD44086063D5E26BD157F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Malware Config

Signatures

Custom signature

Detects executables referencing combination of virtualization drivers 2 IoCs

resource	yara_rule
behavioral17/memory/4600-0-0x00007FFE0AA70000-0x00007FFE0B1CD000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb
behavioral17/memory/4600-1-0x00007FFE0AA70000-0x00007FFE0B1CD000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	4600	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral17/memory/4600-0-0x00007FFE0AA70000-0x00007FFE0B1CD000-memory.dmp	upx
behavioral17/memory/4600-1-0x00007FFE0AA70000-0x00007FFE0B1CD000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\Assistant\2345MgrDLL64.dll,#1
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4600-0-0x00007FFE0AA70000-0x00007FFE0B1CD000-memory.dmp

Download

memory/4600-1-0x00007FFE0AA70000-0x00007FFE0B1CD000-memory.dmp

Download