530f403b50ada2a377ec44ff525fbe6e06fbbc3983707c362a120c8cf24cc821

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
530f403b50ada2a377ec44ff525fbe6e06fbbc3983707c362a120c8cf24cc821.dll
Size 285KB
Sample260701-x77ndafs5z
SHA256 530f403b50ada2a377ec44ff525fbe6e06fbbc3983707c362a120c8cf24cc821
MD5 5a13514a8d2776fc3ff8137d6e3ebd3c
SHA1 50d359cd9670bf2d3ed24b31571e29113cdc1188
SHA512 912f8327e12b2c9bec92a87b2b5d40bfea5341a441dbfdb31ffed6d1e1d6e3f5c9e8db6d2b02c1e4b4c4b6d24b8f50617e45f1a522e23d4442a570032cd95a6e
SSDEEP 3072:J94rZN+YtlkMeR+99nlCxGeedwKQLQB/7OiRPCy3lWBsC1fxgKTQMl87gXV4Z9cy:J9+N+tRU5l0Geed1xtXB1k8Nr6Nj
TLSH
T195547C1AB3A908B9E4B7813DC9579906E7F278560760D7DF03B046AA3F237E0993E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	1268	rundll32.exe
2	1268	rundll32.exe
4	1268	rundll32.exe
5	1268	rundll32.exe
6	1268	rundll32.exe
7	1268	rundll32.exe
8	1268	rundll32.exe
9	1268	rundll32.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.amazonaws.com
3	ip-api.com
4	checkip.amazonaws.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1268	rundll32.exe
1268	rundll32.exe
1268	rundll32.exe
1268	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\530f403b50ada2a377ec44ff525fbe6e06fbbc3983707c362a120c8cf24cc821.dll,#1
1⤵
- Badlisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

log_2026-07_1268.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-07_1268.txt
Size 1KB
SHA256 5f6753ae265f8ae2350d197224d2aaaa3c7cf459c52e460df680e13aef2f3f05
MD5 ba62e65eb18568657ca398b90d78c9c5
SHA1 326147bba16c79ea44536cf81f22193c036b4a41
SHA512 57b83daeeac2de036e906bae469f7b7f870028647d9aee2452be4b32ba63f412735c70124b5a96a6e4fd08ced4784b019a147674d5751d430d3767ca25d5b949
TLSH
T16A313405676BBC7A172A5B86E4026CC1B59870C71793D508ABA8025EC39FE47774C0EF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1268-0-0x0000000180000000-0x00000001801D6000-memory.dmp

Download