bdcf706f3596ffba9d19dd3824d3025cdabedbe65d16e3068ab6289b836be83e

Analysis

max time kernel
899s
max time network
454s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 22:24

Target
patcher/patch.dll
Size 11.5MB
Sample260704-2bd4eaav3n
SHA256 bdcf706f3596ffba9d19dd3824d3025cdabedbe65d16e3068ab6289b836be83e
MD5 9afd172df4394c57b0ac8d080999500b
SHA1 38f57284d8f628c53dd8f43fc809ce7640b46862
SHA512 c38eaf8593e89bbbb6e5a838a64258f0af5398e523938ffc0f35508963886a627bb4636c8c4912438157fad5355ff8b5156bcead828b1d82806e5133bb6ab87f
SSDEEP 196608:HOlZQZgqEh2oCwSThCt83R2hjdiVe/X/42Jdj5yXkeNs0b7/F8ruutSF:HOlCZgqEgzds4R2uVc42JdwXs0HOyqG
TLSH
T11AC623DA17E692F080934A40718B579A3481B69D95FC4D293DD22C02271CEAF758EFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	rundll32.exe
3452	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\patcher\patch.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3112

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3008

memory/3452-1-0x00007FFA7A890000-0x00007FFA7A892000-memory.dmp

Download

memory/3452-2-0x00007FFA56E40000-0x00007FFA5812D000-memory.dmp

Download