37bae69d64485614e98d322daba3f53955d55e64842a5533b7bee119af3699a6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 326B
Sample260706-27rdlsav2m
SHA256 37bae69d64485614e98d322daba3f53955d55e64842a5533b7bee119af3699a6
MD5 61dad0c680fe5cc716ecdbb91f0fca1e
SHA1 f995112bdc2f4a405c6cb7d177fdf7836c72e9c2
SHA512 684de4fe75d09f18bd847d26907a691562170d80e2e17fe38af7d34784ee3dc21954cad705f411dd70de38ef949d7923e4c610a426b515bfb99321c844f72d95
TLSH
T17DE086234C531AB7C5F04A25C8505BADDD57443A5F4784B069FB8CC970B13188595176
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2280	rundll32.exe
2116	rundll32.exe
2308	rundll32.exe
3400	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3684	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3684	powershell.exe
3684	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2280	3684	powershell.exe	86
PID 3684 wrote to memory of 2116	3684	powershell.exe	87
PID 3684 wrote to memory of 2308	3684	powershell.exe	88
PID 3684 wrote to memory of 3400	3684	powershell.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\mal.dll,DllMain
  2⤵
  - Loads dropped DLL
  PID:2280
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\mal.dll,EntryPoint
  2⤵
  - Loads dropped DLL
  PID:2116
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\mal.dll,main
  2⤵
  - Loads dropped DLL
  PID:2308
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\mal.dll,Start
  2⤵
  - Loads dropped DLL
  PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_al3qfnrc.0tx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_al3qfnrc.0tx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mal.dll

Path C:\mal.dll
Size 2.1MB
SHA256 af02612545e4f84920bad38b9fe5ec6c60d6bce656931afe215e42821eb6d319
MD5 466be4079e228e25f9d443df728cc0b7
SHA1 16ca585ddbe423d85fcfcb0e147ea3530e91d4f0
SHA512 15272ffde44d6432f498d36199ebb2b6a8f93b62ce66822728a97cebc2056f5ef1562672b780f95e00c86a02b39e1eb8acd565777a3ffdbc76da7968432c751b
SSDEEP 49152:46Vle7nD0RXAv/JedzLrDx5YKcNDAtjIEx6WdIny0V++:rCURSxedXodNkfx6WEi+
TLSH
T115A52255F9D29B78C5F2823417C341B0B08B24144CAA9FABF6FA9A017C72C9E624775F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2116-19-0x00007FFE25AD0000-0x00007FFE25F2C000-memory.dmp

Download

memory/2280-24-0x00007FFE25AD0000-0x00007FFE25F2C000-memory.dmp

Download

memory/2308-15-0x00007FFE25AD0000-0x00007FFE25F2C000-memory.dmp

Download

memory/3400-28-0x00007FFE25AD0000-0x00007FFE25F2C000-memory.dmp

Download

memory/3684-0-0x000002CC5C8F0000-0x000002CC5C900000-memory.dmp

Download

memory/3684-1-0x000002CC5C8F0000-0x000002CC5C900000-memory.dmp

Download

memory/3684-2-0x000002CC5C880000-0x000002CC5C8A2000-memory.dmp

Download

memory/3684-33-0x000002CC5C8F0000-0x000002CC5C900000-memory.dmp

Download

memory/3684-32-0x000002CC5C8F0000-0x000002CC5C900000-memory.dmp

Download