Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad.dll
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad.dll
- Size 36KB
- Sample260528-gza2faas71
- SHA256 6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad
- MD5 229b41cbb29d718a53671fa5b9e03ec8
- SHA1 2174b193ebc47f8e5041c4c8edb0d40586f65482
- SHA512 4701dca6376031fe5c21f1ef7355f4f566bd4f21d9e5eaae55aba072834511f095f1935ca1aae4a9c612c49a7f8f21596957c646ebeec73cf911c336f841dc7f
- SSDEEP 768:PZwhPf+EXyp1wArfBPHcBPfIBPy+BPUHBN31BPagBP+7BPymBZisBPJVBHHFBPCm:xgFXA
- TLSH T174F2614A97E98581F8F38B395AB253945C76FE110B31C5CF2206A10E1E71BE4ED36B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe 4720 rundll32.exe - Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe 3148 magnify.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3148 4720 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\system32\magnify.exemagnify.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:3148
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_E66BFC327EC64B0EB0CC8695FC2DAD68.dat
- Size 940B
- SHA256 6d6cdbb57ff1c78dd3278bdf2b04eb2153c83777d5b02ea49d5582772f7eb8fa
- MD5 74fd3ebd66fd307db61acdd28b0ca82a
- SHA1 b1d00fd0951340fc202374becf24c2a3c00e1236
- SHA512 60202fd57009a21262326060ce3512f29873be7f71988228df3579a19c0dc8b760f28508f5e03ee1d5bad6bd17957f4fce43470eeffd7fbd6f86dc1af504e0ed
- TLSH T169112B0103D10D07C40D077582600440817099205FA138D7691BD770A11D86008BB101
- MD5 SHA1 SHA512 TLSH