Analysis
-
max time kernel
106s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 09:56
Static task
static1
Behavioral task
behavioral1
Sample
0185f82e97c2a68fef0c28cd8ea81d60N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0185f82e97c2a68fef0c28cd8ea81d60N.dll
Resource
win10v2004-20240802-en
General
-
Target
0185f82e97c2a68fef0c28cd8ea81d60N.dll
-
Size
6KB
-
MD5
0185f82e97c2a68fef0c28cd8ea81d60
-
SHA1
4eb4d2b135097b02ed9c3e1a41071bca2ab253e1
-
SHA256
2717ef41c782a39cb7716343028b920cd12ce9bf06f06e90b54e0678855e89b2
-
SHA512
da28afdf9b2331415918b8d06b33948b4337fde01b3e55b6cbff6c027719df45cc548b064f9b2fb4d4a686f06289d1dbfb0c0897afd27a593ba71ab75b31b72a
-
SSDEEP
48:6AA35YVOQDV8FszwydlAYsLFV3G0ihB+BDq9J5S2:0QDV8FscMjsLFV3kB+FqX5S2
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4956 wrote to memory of 468 4956 rundll32.exe 83 PID 4956 wrote to memory of 468 4956 rundll32.exe 83 PID 4956 wrote to memory of 468 4956 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0185f82e97c2a68fef0c28cd8ea81d60N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0185f82e97c2a68fef0c28cd8ea81d60N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:468
-