37bae69d64485614e98d322daba3f53955d55e64842a5533b7bee119af3699a6

Analysis

user interaction
yes
max time kernel
148s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 326B
Sample260706-27rdlsav2m
SHA256 37bae69d64485614e98d322daba3f53955d55e64842a5533b7bee119af3699a6
MD5 61dad0c680fe5cc716ecdbb91f0fca1e
SHA1 f995112bdc2f4a405c6cb7d177fdf7836c72e9c2
SHA512 684de4fe75d09f18bd847d26907a691562170d80e2e17fe38af7d34784ee3dc21954cad705f411dd70de38ef949d7923e4c610a426b515bfb99321c844f72d95
TLSH
T17DE086234C531AB7C5F04A25C8505BADDD57443A5F4784B069FB8CC970B13188595176
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
5804	rundll32.exe
2580	rundll32.exe
3672	rundll32.exe
4248	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5828	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5828	PowerShell.exe
5828	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5828	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 3672	5828	PowerShell.exe	88
PID 5828 wrote to memory of 4248	5828	PowerShell.exe	89
PID 5828 wrote to memory of 5804	5828	PowerShell.exe	90
PID 5828 wrote to memory of 2580	5828	PowerShell.exe	91

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\mal.dll,DllMain
  2⤵
  - Loads dropped DLL
  PID:3672
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\mal.dll,EntryPoint
  2⤵
  - Loads dropped DLL
  PID:4248
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\mal.dll,main
  2⤵
  - Loads dropped DLL
  PID:5804
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\mal.dll,Start
  2⤵
  - Loads dropped DLL
  PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mal.dll

Path C:\mal.dll
Size 2.1MB
SHA256 af02612545e4f84920bad38b9fe5ec6c60d6bce656931afe215e42821eb6d319
MD5 466be4079e228e25f9d443df728cc0b7
SHA1 16ca585ddbe423d85fcfcb0e147ea3530e91d4f0
SHA512 15272ffde44d6432f498d36199ebb2b6a8f93b62ce66822728a97cebc2056f5ef1562672b780f95e00c86a02b39e1eb8acd565777a3ffdbc76da7968432c751b
SSDEEP 49152:46Vle7nD0RXAv/JedzLrDx5YKcNDAtjIEx6WdIny0V++:rCURSxedXodNkfx6WEi+
TLSH
T115A52255F9D29B78C5F2823417C341B0B08B24144CAA9FABF6FA9A017C72C9E624775F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2580-21-0x00007FFC9AEB0000-0x00007FFC9B30C000-memory.dmp

Download

memory/3672-24-0x00007FFC9AEB0000-0x00007FFC9B30C000-memory.dmp

Download

memory/4248-28-0x00007FFC9AEB0000-0x00007FFC9B30C000-memory.dmp

Download

memory/5804-16-0x00007FFC9AEB0000-0x00007FFC9B30C000-memory.dmp

Download

memory/5828-6-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-14-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-11-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-7-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-12-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-0-0x00007FFCA4CEF000-0x00007FFCA4CF0000-memory.dmp

Download

memory/5828-5-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-8-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-3-0x000001DA7F7C0000-0x000001DA7F7E2000-memory.dmp

Download

memory/5828-4-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-33-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-34-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-35-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download

memory/5828-37-0x00007FFCA4B60000-0x00007FFCA5504000-memory.dmp

Download