2138f27d4914b268074835824a7b03acdcd2a2488fadb16a9a9df0217290847b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e638c87a_gd.ps1
Size 350B
Sample260701-xdgvvset4t
SHA256 2138f27d4914b268074835824a7b03acdcd2a2488fadb16a9a9df0217290847b
MD5 9ca37ed025afc1e0a12d64162b9fd086
SHA1 c3b9cd6259971dab01719438fc2b3a7e6de8b192
SHA512 130800165886038b6af87e3977a68c80e30bebe7ec101b05414ef8de11d5dcee468ccf7dc38572512888dac5565b563abb54bab77582336c500b20e30ce92a24
TLSH
T1E4E0267FD6279651C2106280532849C7E8B2112700C6D43972ECC284BF38553D61686B
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4688	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	4688	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
4704	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4688	powershell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
860	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4688	powershell.exe
4688	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4704	4688	powershell.exe	87
PID 4704 wrote to memory of 632	4704	rundll32.exe	96
PID 632 wrote to memory of 860	632	cmd.exe	98

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e638c87a_gd.ps1
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Downloads\text.dll,Start source=4a2db1f8-b4c381b6
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\cmd.exe
    cmd.exe /c timeout /t 5 & del /f /q "C:\Users\Admin\Downloads\text.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_zi02rdna.q3y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zi02rdna.q3y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

text.dll

Path C:\Users\Admin\Downloads\text.dll
Size 843KB
SHA256 c9b68679ca754e5050bc64b4acd3f5d3c0ffa2b6f61ef68e1837b5ee1847cac3
MD5 78ecb90a5bbe0e4304285e6896e06f90
SHA1 f16c5d04ef29cdad64ac0f2ece6efafbaf2021c5
SHA512 dbfb16f866483b99aea5aa783ef725fe45677069d78e61778acf6c1a887fc28ea387053f7ecb5fd6d7fa566747b66c80d24e42de0192eda23306ca8ee30e0557
SSDEEP 12288:0/FejLfvXhLTtI3sJSHL6feQFZQ/EsUFrj3k:KFejLfvXhPtTxQ/EsUFrj3k
TLSH
T1C805EA535AE70CA9DDD36BBC21D7633AB635FD248B7A8F6B9244C23128131D16E2E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4688-0-0x00000158FD350000-0x00000158FD360000-memory.dmp

Download

memory/4688-8-0x00000158E4CE0000-0x00000158E4D02000-memory.dmp

Download

memory/4688-13-0x00000158E4E40000-0x00000158E4E75000-memory.dmp

Download

memory/4704-15-0x00007FFBF2BF0000-0x00007FFBF2C65000-memory.dmp

Download