90556b75726f4562b47fdc023cf452ef2ee3648b09db41d2bb85dbb408e70aad

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90556b75726f4562b47fdc023cf452ef2ee3648b09db41d2bb85dbb408e70aad.dll
Size 200KB
Sample260801-e18mzsdf42
SHA256 90556b75726f4562b47fdc023cf452ef2ee3648b09db41d2bb85dbb408e70aad
MD5 60e6f86e36c4c97f55e1d702ed2d5a28
SHA1 6d302b62dbe3d48a77a5ccb55d808a37a62adc66
SHA512 a7c0d84f2c700b15a6322853439d4634882a1eb4d9078c4be1fc26f801788d056768c1bf879854617f54265aaf636cbba2bbead9dd6be1defa449a30a44e75e2
SSDEEP 3072:lMUtMIR95ckVPxIiT+xtk5CeeL/YsapUZL8+4LJaMkXexOvqZ6EjIe1iFN1nqyHT:LrymeLIpIaLJabGOvqwoIe
TLSH
T108140803F29374FCC69BC1B48A675A73B572785401346EBFD6A0CA311E72E60A768F25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\beacon_alive.txt	rundll32.exe
File created	C:\Windows\System32\beacon_alive.txt	rundll32.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90556b75726f4562b47fdc023cf452ef2ee3648b09db41d2bb85dbb408e70aad.dll,#1
1⤵
- Drops file in System32 directory
PID:1248

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-0-0x00007FFC347C0000-0x00007FFC347FA000-memory.dmp

Download

memory/1248-3-0x00007FFC347C0000-0x00007FFC347FA000-memory.dmp

Download

memory/1248-4-0x00007FFC347C0000-0x00007FFC347FA000-memory.dmp

Download

memory/1248-8-0x00007FFC347C0000-0x00007FFC347FA000-memory.dmp

Download

memory/1248-14-0x00007FFC347C0000-0x00007FFC347FA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads