55659756853fad925764f3d76ebd2bbb3f8206834e72a5381aada4a4db7987d0

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
图文安装教程.url
Size 170B
Sample261110-wpfaqszy6k
SHA256 55659756853fad925764f3d76ebd2bbb3f8206834e72a5381aada4a4db7987d0
MD5 c4642a38fe27980358006976dfd18cc9
SHA1 8489933c130842289a8d7632f746ac3b100bce2d
SHA512 7fb85693745113419b6f4369b696a6ef3dbb48b4b90a640079ae86a18715f2c3c562e9fcad9c9a93cc6c6f58fe00e831b02c6dcaddc6df723fcda96f60cc2814
TLSH
T1FFC08CE90202C0C6F300900A6170F90E9D0FB2E40EC3DAEA2A8ADF8D3C9D0D2E848665
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Uses Rundll32 to proxy-execute a payload 1 TTPs 1 IoCs

Rundll32 is a signed Windows utility that executes code inside DLLs. It can load specific system libraries to run malicious executables or scripts.

defense_evasion

Rundll32

T1218.011

pid	Process
4672	rundll32.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\图文安装教程.url
1⤵
- Uses Rundll32 to proxy-execute a payload
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads