4abdbea2841bd622a088aa799054ef78e06c46e08244bb6b9e98bad2029e5039

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 22:45

Target
borlndmm.dll
Size 50.8MB
Sample261030-2plqeafw4y
SHA256 4abdbea2841bd622a088aa799054ef78e06c46e08244bb6b9e98bad2029e5039
MD5 f680a5bd25b65a50c305313193555a3a
SHA1 f141b3b565377d328936df690b3330642217b38b
SHA512 de2396f0fa228fbd8fb12e5772811a5e18840bcdcd84650b1a95b1ee040e579f0f21e0bde4d5c80dcbb3faea8365b1469c1fe66164aa5a215f31d7edd106d9c7
SSDEEP 196608:dynrQsT6N3XO1AFDVvYXDmINtOr319IS7C:dynrLWN3e1AF26X3DC
TLSH
T13BC7332AA1380167D472C37DC8A70EC58B5174013BA59ADF0AF0BA043E2BFD6B57A716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 5012	4308	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\borlndmm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" 936107b3c9da
  2⤵
  PID:5012