Analysis
- max time kernel
148s - max time network
118s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad.dll
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad.dll
- Size 36KB
- Sample260528-gza2faas71
- SHA256 6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad
- MD5 229b41cbb29d718a53671fa5b9e03ec8
- SHA1 2174b193ebc47f8e5041c4c8edb0d40586f65482
- SHA512 4701dca6376031fe5c21f1ef7355f4f566bd4f21d9e5eaae55aba072834511f095f1935ca1aae4a9c612c49a7f8f21596957c646ebeec73cf911c336f841dc7f
- SSDEEP 768:PZwhPf+EXyp1wArfBPHcBPfIBPy+BPUHBN31BPagBP+7BPymBZisBPJVBHHFBPCm:xgFXA
- TLSH T174F2614A97E98581F8F38B395AB253945C76FE110B31C5CF2206A10E1E71BE4ED36B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1332 magnify.exe 1332 magnify.exe 1332 magnify.exe 1332 magnify.exe 1332 magnify.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1332 2040 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6924bd7ecf21ef821cc24d1359ad198c9486920f201950e25c61b44386e058ad.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\system32\magnify.exemagnify.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:1332
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_5DCA5A278BDC4B0B96096CB5C75CFB54.dat
- Size 940B
- SHA256 a96da8dd316bdec1a1fa3cd63968004812825dc5f6f0eece83f9d0b36beb16d1
- MD5 2aad67d29ca54efede247b9103602e1e
- SHA1 724e8a4bdd347509a24244fc37057548edeb9734
- SHA512 9d2fc2f32ab95562f360dc1b4d4a658ce5bc103dd0ff1f5933c271057cb9ac95c86ae99b43d226a6485e339024415c2a4d49704e4338f3eb25ebce8ea673ef1a
- TLSH T15C119B400551766CEC3504FDD0547555495115849C0FFB6552398D405177DD4563AA95
- MD5 SHA1 SHA512 TLSH