Analysis
- max time kernel
298s - max time network
301s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 05:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TI.Number-20260819145147.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
TI.Number-20260819145147.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
300 seconds
Behavioral task
behavioral3
Sample
hdp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral4
Sample
hdp.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
300 seconds
General
- Target hdp.dll
- Size 5.6MB
- Sample260823-fnxwdsshjc
- SHA256 d7b7cec28ea90b651e77450011864e756baf721e226827727fe67f7d2502a9ce
- MD5 60ebbcbaa0ce6183119e26e7b4cf29ce
- SHA1 2da77192bc18f29ad85399d8a4068412115c7900
- SHA512 89688b7bf13224d3e70ec0b3fc8d1a4297a4f15268d4eb9fa71c2146165c061a9e4ec411de0e1cd222d37242f706e821e243d7e8d6bdc52c5109cf8f167ae71b
- SSDEEP 98304:g2C7uzfNvxse6NjjsAI+jEqkKmHEpXFxr5n6fyq+nkDOByQfoOiGBx5A2NwKEYos:lV9GAqkKmHEpXFxr5n6fyq+nkDOByQf3
- TLSH T13D56D0313D5D009EE0AA12398F68AAEDF2FE7DA03BB531571980F639FB35B414A1415B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 13 1860 rundll32.exe 17 1860 rundll32.exe 18 1860 rundll32.exe 25 1860 rundll32.exe 26 1860 rundll32.exe 29 1860 rundll32.exe 36 1860 rundll32.exe 38 1860 rundll32.exe 39 1860 rundll32.exe 40 1860 rundll32.exe 41 1860 rundll32.exe 42 1860 rundll32.exe 46 1860 rundll32.exe 49 1860 rundll32.exe 50 1860 rundll32.exe 51 1860 rundll32.exe 52 1860 rundll32.exe 53 1860 rundll32.exe 55 1860 rundll32.exe 57 1860 rundll32.exe 58 1860 rundll32.exe 59 1860 rundll32.exe 60 1860 rundll32.exe 61 1860 rundll32.exe 64 1860 rundll32.exe 67 1860 rundll32.exe 68 1860 rundll32.exe 69 1860 rundll32.exe 70 1860 rundll32.exe 71 1860 rundll32.exe 72 1860 rundll32.exe 76 1860 rundll32.exe 77 1860 rundll32.exe 78 1860 rundll32.exe 79 1860 rundll32.exe 80 1860 rundll32.exe 81 1860 rundll32.exe 85 1860 rundll32.exe 86 1860 rundll32.exe 92 1860 rundll32.exe 93 1860 rundll32.exe 94 1860 rundll32.exe 97 1860 rundll32.exe 98 1860 rundll32.exe 99 1860 rundll32.exe 100 1860 rundll32.exe 101 1860 rundll32.exe 102 1860 rundll32.exe 103 1860 rundll32.exe 111 1860 rundll32.exe 112 1860 rundll32.exe 113 1860 rundll32.exe 114 1860 rundll32.exe 115 1860 rundll32.exe 116 1860 rundll32.exe 117 1860 rundll32.exe 118 1860 rundll32.exe 119 1860 rundll32.exe 120 1860 rundll32.exe 121 1860 rundll32.exe 122 1860 rundll32.exe 123 1860 rundll32.exe 124 1860 rundll32.exe 125 1860 rundll32.exe - Discovers running processes 1 TTPs 5 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 444 tasklist.exe 844 tasklist.exe 3976 tasklist.exe 3572 tasklist.exe 1228 tasklist.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5588 cmd.exe 6136 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe - Delays execution with timeout.exe 5 IoCs
pid Process 1844 timeout.exe 2760 timeout.exe 3368 timeout.exe 5384 timeout.exe 1984 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 5516 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1860 rundll32.exe Token: SeLoadDriverPrivilege 1860 rundll32.exe Token: SeTakeOwnershipPrivilege 1860 rundll32.exe Token: SeIncBasePriorityPrivilege 1860 rundll32.exe Token: SeTcbPrivilege 1860 rundll32.exe Token: SeDebugPrivilege 5516 taskkill.exe Token: SeDebugPrivilege 444 tasklist.exe Token: SeDebugPrivilege 844 tasklist.exe Token: SeDebugPrivilege 3976 tasklist.exe Token: SeDebugPrivilege 3572 tasklist.exe Token: SeDebugPrivilege 1228 tasklist.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2568 wrote to memory of 1860 2568 rundll32.exe 87 PID 1860 wrote to memory of 5516 1860 rundll32.exe 88 PID 1860 wrote to memory of 5588 1860 rundll32.exe 91 PID 5588 wrote to memory of 6136 5588 cmd.exe 93 PID 6136 wrote to memory of 444 6136 cmd.exe 94 PID 6136 wrote to memory of 4760 6136 cmd.exe 95 PID 6136 wrote to memory of 2760 6136 cmd.exe 96 PID 6136 wrote to memory of 844 6136 cmd.exe 108 PID 6136 wrote to memory of 640 6136 cmd.exe 109 PID 6136 wrote to memory of 3368 6136 cmd.exe 110 PID 6136 wrote to memory of 3976 6136 cmd.exe 112 PID 6136 wrote to memory of 3332 6136 cmd.exe 113 PID 6136 wrote to memory of 5384 6136 cmd.exe 114 PID 6136 wrote to memory of 3572 6136 cmd.exe 115 PID 6136 wrote to memory of 4928 6136 cmd.exe 116 PID 6136 wrote to memory of 1984 6136 cmd.exe 117 PID 6136 wrote to memory of 1228 6136 cmd.exe 118 PID 6136 wrote to memory of 5428 6136 cmd.exe 119 PID 6136 wrote to memory of 1844 6136 cmd.exe 120
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\hdp.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\hdp.dll,#12⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5516
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\S-1-5-21-3053180483-1881419501-3594244048\S-1-5-21-3053180483-1881419501-3594244048.CMD3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\S-1-5-21-3053180483-1881419501-3594244048\S-1-5-21-3053180483-1881419501-3594244048.CMD4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:444
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4760
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2760
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:844
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:640
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3368
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3332
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5384
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4928
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1984
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:5428
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1844
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\S-1-5-21-3053180483-1881419501-3594244048\S-1-5-21-3053180483-1881419501-3594244048.CMD
- Size 1KB
- SHA256 7e80250a48b7bf4649b4318a63dd909035a8aac6a1079b38181fd1f429c04423
- MD5 00651da8fd0374ab81fe83d94fb114be
- SHA1 5d0b25a637224f4f8ecf81c8777b5ca142afafe7
- SHA512 dce980519686a99699a409aceda0d1195f5a7011fb03061db0f6cf883dd07454587bb3e08bd6e05d5926e724c16d32c14cf9b61bd017a44b1a04855d354325c6
- TLSH T1A83110CFC80B4E2C437542EF538ADC9FC251E047EE8572D079AC5F84238695D4A59BAE
- MD5 SHA1 SHA512 TLSH