3e56bced17040fe1a3248749ccb87781092fad3ae4c0d543ec3e5936801b40d1

Analysis

max time kernel
148s
max time network
103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
intl.dll
Size 109KB
Sample260916-thf8casfmc
SHA256 3e56bced17040fe1a3248749ccb87781092fad3ae4c0d543ec3e5936801b40d1
MD5 c688f8cbe6c4143f33341cd3a013d3fa
SHA1 de9fd0d2897925ad577dd6be63d503e2c1b4cdcd
SHA512 bd4d90d1c89fbd5df0c636e47b7e74ae7821a62404e37ff9376d3aa4c7764e81f6a69048c580a00da8bf1e9876cb07e6d0ce78061666478996a8498e6aa1c330
SSDEEP 3072:lXHSsC1tqxNRFpPwAbehMUrWuQOI8SNc9E:lXHGqxduAehSuQuS
TLSH
T199B30202BF021F95E1944D7652178F47A16AAC10CBA131E72A7CC6AF1C793D0DCF7AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5668	powershell.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\intl.dll,#1
1⤵
PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\305c054d.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads