Analysis
- max time kernel
61s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d.dll
- Size 8.9MB
- Sample260925-gfalka1dkc
- SHA256 cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d
- MD5 d9be89d28ee264caa143dca8ff564677
- SHA1 72b2a50b8d7df065e6f7bcaf9205adf9d61fa9e5
- SHA512 e301ebc1835bdfbaba6b4da5d00b2067556e2d9732b93fca4636413fa3f376ab0468b5a86a443cb13fb337bc2188e67289975aa172b182d586bfe6a5f02b7e1b
- SSDEEP 196608:oqo0R5Sm4tJXN7iFn6u9LrX8HvkdF3/nR:oU7SmE969LryvkD/nR
- TLSH T16596DF466EE8C0B9C5E6C03DC6278A9BD3F178411933C7DF56954A0A2F337528F2A366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 20 440 rundll32.exe 21 440 rundll32.exe 23 440 rundll32.exe 25 440 rundll32.exe 27 440 rundll32.exe 29 440 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 440 rundll32.exe Token: SeIncBasePriorityPrivilege 440 rundll32.exe Token: SeLoadDriverPrivilege 440 rundll32.exe Token: SeTakeOwnershipPrivilege 440 rundll32.exe Token: SeTcbPrivilege 440 rundll32.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d.dll,#11⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:440
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵PID:1768