Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dllhost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
dllhost.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target dllhost.exe
- Size 187KB
- Sample260721-bhvrmacw7w
- SHA256 aefb0cd70635eca8310b03f87b8e64ddc6f16c2d166c0f8a3d6a2fe977e3f1ee
- MD5 5aae1bfe0c90f547abf1244eae6bbff7
- SHA1 57bb8160c894cc50308f2e3d67477d6b46f3c2cb
- SHA512 dfb633be4b69bfc028b5083ab4042a311a0897c643b150106340ba29c86abbad2c6a14d49cab7731a3959cc870b1f839162cd3ada364a3db84c069b4d81c92df
- SSDEEP 1536:nMiGtqkguGK/Ng/G2mH7VPyM8VTNMQuNdcEl6IfG5sYoaHn:nMBVGKGVY7VPyM8VV0lEI+5s
- TLSH T165144321B113A076E035A037DF8F76C2D7A7683643E146DF8A8F83E94A1ADF61578532
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2464 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe 6012 dllhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6012 dllhost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6012 wrote to memory of 2464 6012 dllhost.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd "C:\Windows\Prefetch" & del "PROCESSHAC*.pf"2⤵
- Executes a command shell one-liner
PID:2464
-