d030fb59b5b48e21db09b5cf6b046595579ee5c06ab63f73da48edebd69f07a4

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 15:40

Target
B9cNbBAxYnu9isg.exe
Size 36.9MB
Sample260623-s4bdjsd16v
SHA256 d030fb59b5b48e21db09b5cf6b046595579ee5c06ab63f73da48edebd69f07a4
MD5 269faa2e2522516fd1b6a77656d52096
SHA1 ac5be12660ff3164cdafc1d21d0d184fd38a11b4
SHA512 caeabee5d7d79867af8b77c112d81b28765dcf337509da41afddadd6e2af83ae6f7c3e8ca8a3f17a3c96f4f4d854d592cd1b8ec72124b17b478db7c11b02a27e
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf0:fMguj8Q4VfvwqFTrYi
TLSH
T1D2878C0773E60095E5B7D1388AA79507D7B3B8638331CADF329D06551FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
5572	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 5572	2688	B9cNbBAxYnu9isg.exe	89

C:\Users\Admin\AppData\Local\Temp\B9cNbBAxYnu9isg.exe
"C:\Users\Admin\AppData\Local\Temp\B9cNbBAxYnu9isg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Roaming\Microcord\neth_proxy.dll Run
  2⤵
  - Loads dropped DLL
  PID:5572

NETH-RUNTIME-LOG.txt

Path C:\Users\Admin\AppData\Local\Temp\NETH-RUNTIME-LOG.txt
Size 304B
SHA256 b62e5c960f1a2674a50b7fbe690b77f898799bb03bc29e63e1f00c5e8a5cb246
MD5 7d3670d06605da47d136da124a33ba67
SHA1 e5d46db0887fd14342c05a1febb7ac378e5d694a
SHA512 e41494055e62c4cf2c3f258b6f2958b4b17fba15b9029d2630a850c997dc381c669f920dc8d37cda204d3fe02f428ad2f8ecc7d4a6749f138663a391814cae11
TLSH
T1DFE08C0022A04825DBAE7143A3880BF8913297272EE8288C09CA181C02069E162EF096
MD5 SHA1 SHA512 TLSH

Submit Download

neth_proxy.dll

Path C:\Users\Admin\AppData\Roaming\Microcord\neth_proxy.dll
Size 385KB
SHA256 66c9f0f5873ea5eaeb7a313cc810f08aef0544b82ebd58c9980448620644e89d
MD5 a6b4614f14865f90a58b8bb011350534
SHA1 bd8592f0975db74241301bccd321156725473b32
SHA512 a0b339bfeb651c42910c4a02ab913b01eb042f3bf207acf0fc047881bce9d780c6386781bed2c469a932613cf541cce1bd0444560fd7949e69dd43ba237c9ac8
SSDEEP 6144:fweLj2x0OATOHWwa6bON+w+5km89nHmpG0qQx7/P5BFxtDO5M7/YRxXSjM:fwb0OeOdauW+wOkp9nCPFxtDYM7Yr
TLSH
T15384F11929D256F9D462C07CC5D1593BB2713C411B26B8FF8CD3C6A92EA2078943BEF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download