2138f27d4914b268074835824a7b03acdcd2a2488fadb16a9a9df0217290847b

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e638c87a_gd.ps1
Size 350B
Sample260701-xdgvvset4t
SHA256 2138f27d4914b268074835824a7b03acdcd2a2488fadb16a9a9df0217290847b
MD5 9ca37ed025afc1e0a12d64162b9fd086
SHA1 c3b9cd6259971dab01719438fc2b3a7e6de8b192
SHA512 130800165886038b6af87e3977a68c80e30bebe7ec101b05414ef8de11d5dcee468ccf7dc38572512888dac5565b563abb54bab77582336c500b20e30ce92a24
TLSH
T1E4E0267FD6279651C2106280532849C7E8B2112700C6D43972ECC284BF38553D61686B
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3656	PowerShell.exe

Loads dropped DLL 1 IoCs

pid	Process
1748	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3656	PowerShell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2236	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3656	PowerShell.exe
3656	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	PowerShell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 1748	3656	PowerShell.exe	89
PID 1748 wrote to memory of 2040	1748	rundll32.exe	91
PID 2040 wrote to memory of 2236	2040	cmd.exe	93

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e638c87a_gd.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Downloads\text.dll,Start source=4a2db1f8-b4c381b6
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\system32\cmd.exe
    cmd.exe /c timeout /t 5 & del /f /q "C:\Users\Admin\Downloads\text.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

text.dll

Path C:\Users\Admin\Downloads\text.dll
Size 843KB
SHA256 c9b68679ca754e5050bc64b4acd3f5d3c0ffa2b6f61ef68e1837b5ee1847cac3
MD5 78ecb90a5bbe0e4304285e6896e06f90
SHA1 f16c5d04ef29cdad64ac0f2ece6efafbaf2021c5
SHA512 dbfb16f866483b99aea5aa783ef725fe45677069d78e61778acf6c1a887fc28ea387053f7ecb5fd6d7fa566747b66c80d24e42de0192eda23306ca8ee30e0557
SSDEEP 12288:0/FejLfvXhLTtI3sJSHL6feQFZQ/EsUFrj3k:KFejLfvXhPtTxQ/EsUFrj3k
TLSH
T1C805EA535AE70CA9DDD36BBC21D7633AB635FD248B7A8F6B9244C23128131D16E2E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1748-21-0x00007FFDF9E90000-0x00007FFDF9F05000-memory.dmp

Download

memory/3656-10-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-11-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-6-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-7-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-8-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-9-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-0-0x00007FFE008CF000-0x00007FFE008D0000-memory.dmp

Download

memory/3656-3-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-12-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-13-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-14-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-15-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-5-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-20-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/3656-4-0x000002594F200000-0x000002594F222000-memory.dmp

Download