Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/09/2026, 00:12
General
- Target main module/winspool.dll
- Size 963KB
- Sample260905-ahcelssgre
- SHA256 5c6f9dc0f273000ce05913cc6f899acb5c89fb2bbcb9e22cfe59a804d16de702
Score
1/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\main module\winspool.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /query /fo CSV /v /nh2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Tmp7402.tmp
memory/2396-0-0x0000024C90AE0000-0x0000024C90AE5000-memory.dmp
memory/2396-2-0x0000024C90BD0000-0x0000024C90BD8000-memory.dmp
memory/2396-3-0x0000024C92600000-0x0000024C92610000-memory.dmp
memory/2396-4-0x0000024C92560000-0x0000024C925B4000-memory.dmp
memory/2396-6-0x0000024C92600000-0x0000024C92610000-memory.dmp
memory/2396-5-0x0000024C92600000-0x0000024C92610000-memory.dmp
memory/2396-7-0x0000024C92520000-0x0000024C92538000-memory.dmp
memory/2396-8-0x0000024C92680000-0x0000024C926CC000-memory.dmp