Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/07/2026, 11:26
General
- Target _2000064d109841c9f620dec6dbba85c1ff6d3b17d4744893ce53ca9957aafa6d.dll
- Size 1.2MB
- Sample260709-nkdbkshv3m
- SHA256 2000064d109841c9f620dec6dbba85c1ff6d3b17d4744893ce53ca9957aafa6d
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\_2000064d109841c9f620dec6dbba85c1ff6d3b17d4744893ce53ca9957aafa6d.dll,#11⤵
- Badlisted process makes network request
- Drops startup file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dpnhupnp.dll
Tmp8344.tmp
memory/2084-238-0x0000017ABB470000-0x0000017ABB480000-memory.dmp
memory/2084-240-0x0000017ABB440000-0x0000017ABB458000-memory.dmp
memory/2084-229-0x0000017AB9850000-0x0000017AB986E000-memory.dmp
memory/2084-235-0x0000017ABB470000-0x0000017ABB480000-memory.dmp
memory/2084-237-0x0000017ABB4C0000-0x0000017ABB514000-memory.dmp
memory/2084-239-0x0000017ABB470000-0x0000017ABB480000-memory.dmp
memory/2084-0-0x0000017AB9820000-0x0000017AB9821000-memory.dmp
memory/2084-236-0x00007FFCC6FE0000-0x00007FFCC6FF9000-memory.dmp
memory/2084-241-0x0000017ABB5D0000-0x0000017ABB61C000-memory.dmp
memory/2084-3-0x0000017ABB270000-0x0000017ABB2E1000-memory.dmp
memory/2084-242-0x0000017ABB470000-0x0000017ABB480000-memory.dmp
memory/2084-2-0x00007FFCD20E0000-0x00007FFCD23A9000-memory.dmp
memory/2084-1-0x00007FFCD4650000-0x00007FFCD4845000-memory.dmp
memory/2084-1667-0x0000017AB9820000-0x0000017AB9821000-memory.dmp
memory/2084-2308-0x0000017ABB470000-0x0000017ABB480000-memory.dmp
memory/2084-2590-0x0000017ABB470000-0x0000017ABB480000-memory.dmp
memory/2084-3378-0x0000017ABB470000-0x0000017ABB480000-memory.dmp