872caafdb23c8e84124877c6877135e1b2b5085df92a47ea0f059b44fd27b9fd

Analysis

user interaction
yes
max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 14:30

Target
version.dll
Size 1.1MB
Sample260709-rt43facy2s
SHA256 872caafdb23c8e84124877c6877135e1b2b5085df92a47ea0f059b44fd27b9fd
MD5 9ba816d4cab79076d46a8c14a24edc3e
SHA1 06bf57511de95cf231b7f8e69826593be5c6253f
SHA512 8a7f26ca49ce48a3fc7f8514f1b1d7ca56d53774931ad033910c33264d2987e18ff6ed25e1f8deb8d1888fa7c729cb1dfd76e8e75553c6626098e673df101db1
SSDEEP 24576:zPt8bpqWX6OiKg+eCZ8J32Cy2oRPOSBmUNfsDOON4/Ggn6a+RH:zspb6zty81/noRPOSBmUNfsDN4/Bn61
TLSH
T12D359E59B2B441F8D07BE078CA83A90BE6313848073499FB67F04D565F637E15ABBB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 5560	4596	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5560