Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 06:39
General
- Target tmpfh09cpzs.dll
- Size 146KB
- Sample260602-he1a9sft71
- SHA256 55f8996aaeb9b14ea0f1c2b653aa5db107d5182a23c42c6e333d72893981ae13
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 13 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tmpfh09cpzs.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tmpfh09cpzs.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3044-0-0x00000000012D0000-0x00000000012FA000-memory.dmp
memory/3044-1-0x00000000012D0000-0x00000000012FA000-memory.dmp
memory/3044-4-0x00000000012D0000-0x00000000012FA000-memory.dmp
memory/3044-5-0x00000000012D0000-0x00000000012FA000-memory.dmp
memory/3044-3-0x00000000012D0000-0x00000000012FA000-memory.dmp
memory/3044-6-0x00000000012D0000-0x00000000012FA000-memory.dmp