fbab7699a3ed3b40ae464e6c9a487be078dc0cb38e5681ffa6ffeb6ba49d1b26

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64dll.dll
Size 169KB
Sample261102-vm1m8ady5p
SHA256 fbab7699a3ed3b40ae464e6c9a487be078dc0cb38e5681ffa6ffeb6ba49d1b26
MD5 fb8b292c7d0316d2470484483c5e4f67
SHA1 bc6387792aae8f2e64eb24487ee660797fb68b5d
SHA512 6b6289e37c830d58beb6890af60469b83b32014be2af1235d8e3a059e1bc07d835f3aa26abc800920b7665ec240854853a7c0e457a140133675eb8ac9505bb84
SSDEEP 3072:VcWpaIa30OlFbTF2oK5Ci1+epVlSSXbjXmaRjdv21ngniiFa:V9s30UTNWCi1n/XvBza
TLSH
T1BA044A4376A400FAE467D279C9935A06E3B334560775A7CF526087BA1F233E2BE3A351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1100	rundll32.exe
8	1100	rundll32.exe
10	1100	rundll32.exe
11	1100	rundll32.exe
12	1100	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64dll.dll,#1
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44c_e596d76.zip

Path C:\Users\Admin\AppData\Local\Temp\44c_e596d76.zip
Size 162B
SHA256 04d05d081b16015f741154a16ddb09b1b1c3f3d34d6c3a0faf1ac0639d6c9587
MD5 0329f5277f501e5a853997ea60d0953b
SHA1 bc5d35ff64bbe468690e5e097e66f9165dd2981e
SHA512 2bffddd7dc0e5f2fb0b70c9d96d6b419992f163eb8b460a5ec3008244968f64be5366f54c9160ef92c5be25cb1176078dfd2deacab0bb6ed445c3a0867a2c4f7
TLSH
T154C02405D55D1C04451D1CF1FD313477D40005C55D5F11D175F47155F5537D55370344
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1100-0-0x0000000180000000-0x000000018001A000-memory.dmp

Download