Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 18:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bffc591fc0bcc1efa168db3c3981d5d62de5104a3020d51babece37eaee9038e.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bffc591fc0bcc1efa168db3c3981d5d62de5104a3020d51babece37eaee9038e.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target bffc591fc0bcc1efa168db3c3981d5d62de5104a3020d51babece37eaee9038e.dll
- Size 6.5MB
- Sample260528-wvew6aat21
- SHA256 bffc591fc0bcc1efa168db3c3981d5d62de5104a3020d51babece37eaee9038e
- MD5 cce783bac5ffd5f9ab653dc25d2b18b4
- SHA1 1f6d7fde6af0d8c4c03a0bc4c12ecdd60a3f8e24
- SHA512 71230cc21d9b998a986ed02f7c4f0c92dc5545c3fd4433141044ae5485a07dea1db0b30cccfb588fd64a4fba8548fe4b587b314f53f8191ea04d666cf53a0fab
- SSDEEP 49152:tVj2ZkzhIIt11SVTeKMl35UbAf+6Qvq3A2toMufDtEZ2bipVSHKExP2kSCjhH:Tt117
- TLSH T15E66BF6B719804A1CC169370EEF17D4DE6B0724B07845ABB4EFBAB5C6EDA7C080F9944
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2256 rundll32.exe 4 2256 rundll32.exe 7 2256 rundll32.exe 8 2256 rundll32.exe 10 2256 rundll32.exe 12 2256 rundll32.exe 14 2256 rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2256 rundll32.exe Token: SeDebugPrivilege 2256 rundll32.exe