15ee5851ff1b33e369b43c66d44e3d1452a212c2a37f337b680fe8bd88df8748

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/06/2026, 00:18

Target
ModEngine/lua/dlls/MonoDataCollector64.dll
Size 535KB
Sample260603-alkv6agy6r
SHA256 15ee5851ff1b33e369b43c66d44e3d1452a212c2a37f337b680fe8bd88df8748
MD5 4237719534b21bb179480ed8bb23c0cc
SHA1 a1c8db76137b6131b7b8fe379841cb3df62f3b7d
SHA512 4ace9a2ca9beaf64a3b097922300e6bf46729375cb4dfa4bc3d81b0420ff28cd45c2cfdb9c05e4885ddd39cb6bf160d932be4711c219302d684d23afeadb4f72
SSDEEP 12288:7dShHq6xdR8zWUjwmoRb2qORTCKTJ7PYn:Z6xdqzWUjwmr8n
TLSH
T1EDC47C1ABB9843B5E067D138C8939542E6F1B40A1B70DBDB53E0427E1F773A15E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1820	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ModEngine\lua\dlls\MonoDataCollector64.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1820