38f971647b42d13a8cc01e1efe22dbbc3725e3c200885997008db55a08d7ca05

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
service.dll
Size 1.4MB
Sample260827-r73frsan21
SHA256 38f971647b42d13a8cc01e1efe22dbbc3725e3c200885997008db55a08d7ca05
MD5 da2b5c4dbe8ca9480873e68009d08009
SHA1 22de716e3aab64fce6748244282fc55454052bfd
SHA512 4989009acfdb1bcd3cfb8ef31a32360ee8b48983988e72fbb14f295c83a73350847f18c38777d3cf9b68c191c3826296a3e0f1275a7d2c2fa68cfa032e25a804
SSDEEP 12288:vBhP+LHQlN5YVBQho8wRUIO8e/uCOgxrsFTIxI1Kq7EIoNL0Eh9/lKenZUSEvW01:5IOUzBl
TLSH
T13065F524BDBBC12D4023FB682DDDF4AFE6AA231A1589787B404903174F6DB958B4707E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3480	rundll32.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\service.dll,#1
1⤵
- Badlisted process makes network request
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads