Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
ac16bc0727ca79d839410cdc14cfef3345c97839d7c81df4853b800dda2c6508N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ac16bc0727ca79d839410cdc14cfef3345c97839d7c81df4853b800dda2c6508N.dll
Resource
win10v2004-20241007-en
General
-
Target
ac16bc0727ca79d839410cdc14cfef3345c97839d7c81df4853b800dda2c6508N.dll
-
Size
6KB
-
MD5
27163f76c0e49b12559a9b2a304f39b0
-
SHA1
ed97bb27739b558450932aa1d094bef950aa782f
-
SHA256
ac16bc0727ca79d839410cdc14cfef3345c97839d7c81df4853b800dda2c6508
-
SHA512
272e32a61a94267307a73331266f0768ccd8481befac3ec3f62f92653918fd99b22de60ea711722f9e54619c9cffae13b3bd0e5490b52ea81dcb9aa3cf989d5f
-
SSDEEP
96:nEY2RrF1eqwi4BOZad6mzZHSEm5+lUv8oy1eKy4vLI45dWfzA2a:EHRh1epppLHSf+lo8DyY+zda
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 2156 wrote to memory of 2244 2156 rundll32.exe 30 PID 2156 wrote to memory of 2244 2156 rundll32.exe 30 PID 2156 wrote to memory of 2244 2156 rundll32.exe 30 PID 2156 wrote to memory of 2244 2156 rundll32.exe 30 PID 2156 wrote to memory of 2244 2156 rundll32.exe 30 PID 2156 wrote to memory of 2244 2156 rundll32.exe 30 PID 2156 wrote to memory of 2244 2156 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac16bc0727ca79d839410cdc14cfef3345c97839d7c81df4853b800dda2c6508N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac16bc0727ca79d839410cdc14cfef3345c97839d7c81df4853b800dda2c6508N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2244
-