8a0c002261568c369e60f266e780231d8bb811a779e8a117df09768fa36819b2

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a0c002261568c369e60f266e780231d8bb811a779e8a117df09768fa36819b2.dll
Size

80KB
MD5

c020b325e88d20d80345e7c99f910869
SHA1

b1c0f8d47e0b2d698e4b075c82024b473655f8be
SHA256

8a0c002261568c369e60f266e780231d8bb811a779e8a117df09768fa36819b2
SHA512

b55b5aba60a94389ea7129c37be6f8c02bd55c9c914c1be54c4895ed15da646e5885d18b4689a38ba67fb0f8c3aafe34935fe20157666ecce154c70f03472244
SSDEEP

1536:8iONFeneJA6CU+1VZoq94XTb2Tr2hyesoVb:8iZeJCUvROOhnsoVb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 4896	3192	rundll32.exe	84
PID 3192 wrote to memory of 4896	3192	rundll32.exe	84
PID 3192 wrote to memory of 4896	3192	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a0c002261568c369e60f266e780231d8bb811a779e8a117df09768fa36819b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a0c002261568c369e60f266e780231d8bb811a779e8a117df09768fa36819b2.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads