Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 04:21
General
- Target libpsl-5.dll
- Size 11.7MB
- Sample260714-eypgbsd19p
- SHA256 7b98bdc168a9c682be8d432bdd383da72b241909fb955332dbdb09f45c8e4a51
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libpsl-5.dll,#11⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\WinPslUpd" rundll32.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dpnhupnp.dll
DCRCVDrv.sys
memory/4676-2-0x0000000000010000-0x000000000003D000-memory.dmp
memory/5456-4074-0x0000000000400000-0x0000000000470000-memory.dmp
memory/5456-4075-0x0000000075162000-0x0000000075163000-memory.dmp
memory/5456-4076-0x0000000075150000-0x000000007590C000-memory.dmp
memory/5456-4077-0x0000000005A60000-0x0000000005A7A000-memory.dmp
memory/5456-4078-0x0000000005A80000-0x0000000005AAC000-memory.dmp
memory/5456-4082-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4108-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4166-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4202-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4200-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4198-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4196-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4194-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4192-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4190-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4188-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4186-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4184-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4182-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4180-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4178-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4176-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4174-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4172-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4170-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4168-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4164-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4162-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4160-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4154-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4152-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4150-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4148-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4146-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4144-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4142-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4140-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4134-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4132-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4130-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4126-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4124-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4122-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4118-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4116-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4114-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4112-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4110-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4106-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4104-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4100-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4094-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4092-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4090-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4088-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4086-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4158-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4156-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4138-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4136-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4128-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4120-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4084-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4102-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4099-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4096-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4080-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4079-0x0000000005A80000-0x0000000005AA6000-memory.dmp
memory/5456-4707-0x0000000006200000-0x0000000006266000-memory.dmp
memory/5456-4708-0x0000000075162000-0x0000000075163000-memory.dmp
memory/5456-4709-0x0000000006C70000-0x0000000006D02000-memory.dmp
memory/5456-4710-0x00000000072D0000-0x000000000788A000-memory.dmp
memory/5456-4711-0x0000000075150000-0x000000007590C000-memory.dmp