bd2d808f3c580051025a9d3222741db00c6af457e31a7b10d0ed6f081fa66295

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
intl.dll
Size 109KB
Sample260622-e7xjasgz3n
SHA256 bd2d808f3c580051025a9d3222741db00c6af457e31a7b10d0ed6f081fa66295
MD5 aba1dbc953bd3c9089b4229e0b990704
SHA1 f5183a93f1f0041e74c94f94df7c27f14ff397fa
SHA512 0ddd071a64a24be85c902d66e9f90a8cde568504354cb2bcfa4ba4452ffc937b36603e6560d3ec052b2e38a3a8e2f571b628cda56a607af2f06892500ed0eab7
SSDEEP 3072:GfA06uzEJBiwSM0aWLleHcBisI84HJo+thm:GfAqEvFSxaWLgUq5p5h
TLSH
T122B30233F41877A6C5940974E1578E41DAF428918F90C3D31BBA231D6EB4BE8267BBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4216	powershell.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\intl.dll,#1
1⤵
PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ea437358.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads