Analysis
- max time kernel
148s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa24437389e38fd323e24ae94715b0037f8edfd6e9c71c6aefd1bf5f6aaac57c.dll
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa24437389e38fd323e24ae94715b0037f8edfd6e9c71c6aefd1bf5f6aaac57c.dll
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target aa24437389e38fd323e24ae94715b0037f8edfd6e9c71c6aefd1bf5f6aaac57c.dll
- Size 6.1MB
- Sample260809-dav4jasxbv
- SHA256 aa24437389e38fd323e24ae94715b0037f8edfd6e9c71c6aefd1bf5f6aaac57c
- MD5 d11ea92f32b78f2eb2a85c8a6f722db3
- SHA1 8f97bc0c1965b77b94c45a44cd8cef0a6984f096
- SHA512 bc904577ef50615f8cff0054b4b182d76b9ed9beccbd7b1a419f4e71a3bd82c9c47911254c09a86e724f5c2673aa75ed8354152a319e8dc0f0236bf0f5f01613
- SSDEEP 49152:DfqvHh/FWvRx0+fquCm0Jd/g+3boNtx7qgCuiVRRN+RkpTvcUZpCzCzxQl:DEsfqzm0+HzCutRkpTVZNx6
- TLSH T16A56590BBB9168B0C454E734487A5296BA74BC8EC734B3B31D91AD386F293D1693CB53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4152 rundll32.exe 7 4152 rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4152 rundll32.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4152 rundll32.exe 4152 rundll32.exe 4152 rundll32.exe 4152 rundll32.exe 4152 rundll32.exe 4152 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aa24437389e38fd323e24ae94715b0037f8edfd6e9c71c6aefd1bf5f6aaac57c.dll,#11⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4152