Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 22:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
989bbb3c8127c744b6428343eee5ab50c13693dcb6c5bed0ab83cf2daa18321b.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
989bbb3c8127c744b6428343eee5ab50c13693dcb6c5bed0ab83cf2daa18321b.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 989bbb3c8127c744b6428343eee5ab50c13693dcb6c5bed0ab83cf2daa18321b.dll
- Size 36KB
- Sample260825-2c2abszclb
- SHA256 989bbb3c8127c744b6428343eee5ab50c13693dcb6c5bed0ab83cf2daa18321b
- MD5 282235c49dd4bb4bad3eafe22a509ecf
- SHA1 87e180c7e9df094cebb330db8b20cc873c39484e
- SHA512 17aaed164779e1604743e0dba727524778a128e04e0fa3d1eb85d444138bb973e7765d180bd4a26cce5fff8e6dccba280c1a7702be3fa70244ad009672e4460f
- SSDEEP 768:KZwhPf+EXypmwA46BPHcBPfIBPy+BPUHBN31BPagBP+7BPymBZisBPJVBHHFBPCm:GgFXa
- TLSH T174F2604A97E98581F8F38B385AB253945C36FE111B31C5CF2206A10E1E71BE4ED36B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe 1384 rundll32.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3240 magnify.exe 3240 magnify.exe 3240 magnify.exe 3240 magnify.exe 3240 magnify.exe 3240 magnify.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1384 wrote to memory of 3240 1384 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\989bbb3c8127c744b6428343eee5ab50c13693dcb6c5bed0ab83cf2daa18321b.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\system32\magnify.exemagnify.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:3240
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_C447F3B4CBE047D397D67B12C30CAFE3.dat
- Size 940B
- SHA256 feb5305789287025245db8fc423c076d9783da18f5a348b7a6a6a79833f5f042
- MD5 7ec3c12de382302c25fc10d4312e6973
- SHA1 935213570cbd9a5cc7e34f35794cc323896606d1
- SHA512 7a5b2571cb6e2a19388e5cc499f2fe6f1249ee9598cabd00bf46edfef2f62d7319eaf66df2f9dbd83faea4dd49612b6bb08f4e617ef3e304215ba572a116eaab
- TLSH T170112B20C2CC1C80DF8110FD11C031B008262204C00CF85BA4B00C5060D3C9C4423401
- MD5 SHA1 SHA512 TLSH