00400b97793eb9ff23145e56cd03fa7e977aa14222a2d9bcd8daddafbeea3178

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:46

Target
memoriam.dll
Size 13.4MB
Sample260810-ebnaravtcz
SHA256 00400b97793eb9ff23145e56cd03fa7e977aa14222a2d9bcd8daddafbeea3178
MD5 72d2b17143f8124611b2585855bd35c2
SHA1 424a44076941761ccea2dee19eaf286f84afded2
SHA512 3d3abb323c9ad51ea7a7a5b027cfc43ec8016a49cc6b73ba92812eb73218e8cfe119a501a0ce3e35fd2a1ae6323a5780f6ce8786dbbb1ce61de7fca01f200138
SSDEEP 196608:/AhMbGr61oSLtGDlI6ekdcXUqcL4OLoyliWA8V91IbiD1bU+/Tr9T1H5UkaaGxJ8:/AhMiEoi+lWkd3qlO0+nx1bjTRp5D+
TLSH
T182E623E344C826A9D5CF8334E04E0B4EB0E1B7919EA6B609B7C68C43EA71FDB8545753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1200	rundll32.exe
1200	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\memoriam.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200

memory/1200-0-0x00007FFF080D0000-0x00007FFF080D2000-memory.dmp

Download

memory/1200-2-0x00007FFEE4800000-0x00007FFEE5F37000-memory.dmp

Download