Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b53cda93234482a8c2369722b4e7b43fcf08fc4a60662343ea6d40dfd570f148.dll
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b53cda93234482a8c2369722b4e7b43fcf08fc4a60662343ea6d40dfd570f148.dll
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target b53cda93234482a8c2369722b4e7b43fcf08fc4a60662343ea6d40dfd570f148.dll
- Size 6.1MB
- Sample260809-ee3vlstse1
- SHA256 b53cda93234482a8c2369722b4e7b43fcf08fc4a60662343ea6d40dfd570f148
- MD5 2ee8cd2b3d1f6d691835f3f113acb60d
- SHA1 931f8e9d325c41876cf700f68cddadeb517ef102
- SHA512 714283628e2d29a272668a73a1ae9c40d46da3cb07b9556101ca4757c7f9f47bf50197b4f225b4dea83f25fd64f15b38b31ebbce84f5a431303345a148e0863e
- SSDEEP 49152:x4abbQ70M924Lioyw8qfN20XS2tEb2uq2Mi212c2cF2Vf2Ek2AI2oY2S2WWZIRMF:xz2iop8qHMWc0oAQYrSQj3e5px7
- TLSH T155565B07BF5218B4C098EB35847A4295BA74BC8C8734B3B72D92AD786F293D1593DB43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 2812 rundll32.exe 8 2812 rundll32.exe 9 2812 rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2812 rundll32.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2812 rundll32.exe 2812 rundll32.exe 2812 rundll32.exe 2812 rundll32.exe 2812 rundll32.exe 2812 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b53cda93234482a8c2369722b4e7b43fcf08fc4a60662343ea6d40dfd570f148.dll,#11⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2812