Analysis
- max time kernel
44s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
23/01/2026, 17:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HPReport.exe
Resource
win10v2004-20251231-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
HPReport.exe
Resource
win11-20251231-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
HPSmart.exe
Resource
win10v2004-20251231-en
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
HPSmart.exe
Resource
win11-20251231-en
15 signatures
150 seconds
Behavioral task
behavioral5
Sample
InstanceFinderDlgUI.dll
Resource
win10v2004-20251231-en
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
InstanceFinderDlgUI.dll
Resource
win11-20251231-en
2 signatures
150 seconds
General
- Target InstanceFinderDlgUI.dll
- Size 754KB
- Sample260123-wevyfacx7f
- SHA256 4a0dfe9a33ce169986ffef8d40a44f2ae868b15976443b5b87756c8146d27478
- MD5 dd0a9a725528bbf363ee7ad0a4fabdea
- SHA1 150fd577f5017d590cfdeb93b2160d21816b59c4
- SHA512 fbf277a37fe8a214b4fde6ce5d9994f55f7c42cc59eb0f855ae540c6317163a7a729b8326ff2125a9241244658a3a4d853b8c4ea9cd315dacbd6ec67bf62ed09
- SSDEEP 12288:hvhS4iOAZRC3E+L6IR+KVDh4WKpUHg5XuuZKlEGq8H9WN/4r2fi7OBzDp:hZS4nAZRMUKJhEpSg5XlhGq8HQNQifio
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1144 wrote to memory of 4632 1144 rundll32.exe 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\InstanceFinderDlgUI.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\InstanceFinderDlgUI.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4632
-