Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d7327ce606fa6ebea29c59fa50269d61ad07ae0491263a98808be320acbc06b8.bin.dll
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d7327ce606fa6ebea29c59fa50269d61ad07ae0491263a98808be320acbc06b8.bin.dll
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target d7327ce606fa6ebea29c59fa50269d61ad07ae0491263a98808be320acbc06b8.bin.dll
- Size 8.4MB
- Sample260811-2gfjeshb29
- SHA256 d7327ce606fa6ebea29c59fa50269d61ad07ae0491263a98808be320acbc06b8
- MD5 f8e0884b1207c8a3f406ec3e58ddd935
- SHA1 89bd95259b9beccf36e24108e6a0008acb36aef6
- SHA512 22dc3d837c63480683a3a6c7ea25f45aeed0976f830bf2d4df11cefcbc08d60be6ae0f749aba51887a7ee0e570801f4909262dc6972bd61e57f4945c7878a520
- SSDEEP 49152:Y2MJpUUQP1nuhPFjMJDmATz1FznWwjH1WkXszzjpqNPzTbVXbvNTZq86VXOHZb47:YdKqO9a4/mEr+4ESm7+LGjf
- TLSH T1B2964A17D6464EB4E999DB3588BB9117F6607C6E833433A70E137EB42F253912E38B60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 5952 rundll32.exe 8 5952 rundll32.exe 9 5952 rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5952 rundll32.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5952 rundll32.exe 5952 rundll32.exe 5952 rundll32.exe 5952 rundll32.exe 5952 rundll32.exe 5952 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7327ce606fa6ebea29c59fa50269d61ad07ae0491263a98808be320acbc06b8.bin.dll,#11⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5952