1cb9e9aecbab5dea524e30673b8fdea7679a2e5a2ac2ab4e941a6bc5dd942008

Analysis

max time kernel
899s
max time network
464s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 02:36

Target
Nature.dll
Size 15.8MB
Sample261027-c31daace44
SHA256 1cb9e9aecbab5dea524e30673b8fdea7679a2e5a2ac2ab4e941a6bc5dd942008
MD5 970422c6ada34518b5621607c40d3b16
SHA1 072ae7a9bdd57b13b0b1845e95b97ea557c0d339
SHA512 fb83c5098f73ce48b14300cc6dfcc7ca4facb18255b7e6c7f668429832f40d270549b8e9e75e6c19d82a140636a0e56f1f1de862555a105407105796db1da115
SSDEEP 196608:UTDAnytwViyc7iEp2yRSAVjEiaqXFSHuEicF1x1K2hO9qEs7BOsfEMRF6+i8Ihun:UTDAnytlE91thPhREMRFTIhuWo
TLSH
T107F6AD836219388BC061A7BC4403927DF19EF80D9B55C7F79AD7FC2A99E71811E11FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3908	rundll32.exe
3908	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Nature.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4968

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2740