41c9d25245cc813855ff97eb2f5c3ae36971717c10ed49895e089a0873a05c44

Analysis

max time kernel
148s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 17:13

Target
CITIBANK PAYMENTS 26-8-2026/winhttp.dll
Size 1.7MB
Sample260826-vrtepstajg
SHA256 41c9d25245cc813855ff97eb2f5c3ae36971717c10ed49895e089a0873a05c44
MD5 fae2e634ebb107674fe3d80c45f0fa0e
SHA1 d2f115637daf0945cac2beead39454b94fdf7de6
SHA512 345b14d144d328d3ac427d38fd8d8a6303ee33e209c5755a7fb13b6a2163fe2dd588a62971b031ff6b4a1c9ea6423a92b7aa96c9dcc5a6a9c6161208c971e860
SSDEEP 1536:C5z2Ko1BzgpRE99BkCCo1sHyAMx8EyvNX2VTYqJqmwDhEcmXnX1+xtPLnt47o3a3:
TLSH
T13885D5381C24EC15B42927CDE9934F8654D1269FEEAFDD03960DD1BB00B6ABB192F4D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	1052	rundll32.exe
4	1052	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CITIBANK PAYMENTS 26-8-2026\winhttp.dll",#1
1⤵
- Badlisted process makes network request
PID:1052

memory/1052-10-0x0000017F37E80000-0x0000017F37EEE000-memory.dmp

Download