adbcaae34947d76e04d15b29547f07f000b2c776d2e5cf979d8e1564fabd9822

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbgcore.dll
Size 1.5MB
Sample260727-trcaraxtdv
SHA256 adbcaae34947d76e04d15b29547f07f000b2c776d2e5cf979d8e1564fabd9822
MD5 42db674c8120a5ca4502746a33f59263
SHA1 eed9548e9b6efbe8c904b572ae92a32b95ba94f6
SHA512 e8435c623f5538e080bfad1d2422f8d5ae3a828ce1f919f27e71cdd0591ed8f430244943177989ee3d9b1e3da93abf3de1da4d976c8a0a4ca84747f419c6dad4
SSDEEP 6144:P4XUuJWobj1p6eHtFXwbS0PaXK3To4croD0bU0:rukAXMPvTg40l
TLSH
T1DE656D82FBC5BC57DEA50631899F83693338FAD017A36B2319B47E345E039D0AE85647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chromium_Updater_Updater_Version_1918 = "\"C:\\Users\\Admin\\Downloads\\Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe\""	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4848	2412	rundll32.exe	89
PID 2412 wrote to memory of 4848	2412	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbgcore.dll,#1
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-0-0x00007FFE8BC70000-0x00007FFE8CC70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads