8ce5067162b095958f82aae58b375228d6f0e987ee643729f6c860c74a2be055

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
多多软件站-提供绿色软件和热门单机游戏下载.url
Size 151B
Sample261110-wpfaqszy6k
SHA256 8ce5067162b095958f82aae58b375228d6f0e987ee643729f6c860c74a2be055
MD5 45c18450ef1bb6b023956b704797f7b3
SHA1 41dc152a5cb6e6fd8c8fb6e0203221c8fe0de3bb
SHA512 e6844e78a5ab4e323b2d8fd2960a1da326d333dc3096fda1c1e030a76f25e22858754623176add769e6a86c54de6cd7d877b5005891dfff689662acf176bca7a
TLSH
T140C08CA80101C0C6D300800A20B0F909990F716009C2C2A92A45DF492C8D0C2E048665
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Uses Rundll32 to proxy-execute a payload 1 TTPs 1 IoCs

Rundll32 is a signed Windows utility that executes code inside DLLs. It can load specific system libraries to run malicious executables or scripts.

defense_evasion

Rundll32

T1218.011

pid	Process
3728	rundll32.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\多多软件站-提供绿色软件和热门单机游戏下载.url
1⤵
- Uses Rundll32 to proxy-execute a payload
PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads