3623c9f52b5915747e31f3bae7b3480e764bd57cc26f42d4fbaf0f3b8b7b0a8f

Analysis

user interaction
yes
max time kernel
899s
max time network
890s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:24

Target
payload.dll
Size 166KB
Sample260809-w168latcpg
SHA256 3623c9f52b5915747e31f3bae7b3480e764bd57cc26f42d4fbaf0f3b8b7b0a8f
MD5 08217e9e638bc77f0c31dd231022f195
SHA1 e7139169b21a6f6e3bfde97d20b38dd6aa71abbb
SHA512 da3e4f78b45409b95a494e468d7dccb8ed2aa4addd7fe0b678b88eb4c8c2e92fdaeb85a6bf105c9cf0d71f72fcbc26e4a84cf68515de7d06c69bf499cd0a350a
SSDEEP 3072:UR7C6goA5oF1fTh3Fg0gIGZuVtFPLKSCgcDea:CCb5onr000aFj3a
TLSH
T164F37D16F6BA407FE9678534C9530905EB727C835790AAEF53900AF65F2B7D08A3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2620	rundll32.exe
2620	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\payload.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5008

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:936

memory/2620-0-0x0000024868260000-0x0000024868312000-memory.dmp

Download