3133fde53f074c7138092c873ffa8840756cb13b68aeac0ae5abe586fe3ae704

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 17:42

Target
exfrpc_windows_amd64.exe
Size 16.8MB
Sample260724-v925katvb1
SHA256 3133fde53f074c7138092c873ffa8840756cb13b68aeac0ae5abe586fe3ae704
MD5 c9cd9fa0deb6ce882f57e8ab22c7e38b
SHA1 ff6f69d3479ac1665a10633d4222bcbccfa54f17
SHA512 4f04088935930bf93b570d935d95b532ee67c1620f371a8e3eef59f9c054f603c250e594cedcef638bc23663bef3e1c92048d771086f0d4b264c527d57c4a910
SSDEEP 98304:poNAZB+77UmxTLstyzcAn9j8qoKEGEoyUvaqQ+EI3ERg:poTUITLs3AReKEtUE+r0R
TLSH
T10D076B57EC6215F5C0A9D230C6669262BB317C495B2123D77F60F6383F72BC0AABA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\exfrpc_windows_amd64.exe
"C:\Users\Admin\AppData\Local\Temp\exfrpc_windows_amd64.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1992