8dd5eeff1325ebd066df1fdf3f379fa25f7328b367b2e337cd98ca91dc436598

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
App/ImageTuner32/itpr.dll
Size 541KB
Sample260418-baxagset3s
SHA256 8dd5eeff1325ebd066df1fdf3f379fa25f7328b367b2e337cd98ca91dc436598
MD5 243180cb1538a9b2ec675a657aa04882
SHA1 bf0986be1123cfd5f957bdb0447136469e08c1e2
SHA512 ef29bba4fba5ecdb262ac90ac112187cde81e109c4981c1b2511904e31676161a80a1026f6395b34f8e7c17584d797a9b34f9eec1c15fc9b99045c69f0a1201b
SSDEEP 12288:MNt5sxeuGGFN1Tam1IljfSPosK5Cvt3zFZa0j4Bic3Mbqg1i:A2ekNRKljf8jK5Cvt3jGN3xei
TLSH
T19AC42301EA846D86D0DEE4F5A4F3CE801BB266B56D1D05C656E563021FF69E0FC3C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1500	1408	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\InprocServer32\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\0	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\TypeLib\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\Version\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\Programmable\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\0\win32\ = "%systemroot%\\SysWow64\\pmcsnap.dll\\1"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\FLAGS\ = "0"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\TypeLib	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\TypeLib\ = "{B04972CD-0B4F-5207-36FF-B35A9133C4E9}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\ProgID\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\ProgID\ = "Microsoft.Update.Installer.1"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\Programmable	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\FLAGS	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\ProgID	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\FLAGS\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\Version\ = "2.0"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\ = "Pehol Hocar object"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\InprocServer32\ = "C:\\Windows\\SysWOW64\\wuapi.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\0\win32\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\0\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\0\win32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\VersionIndependentProgID\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\VersionIndependentProgID\ = "Microsoft.Update.Installer"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\1.0\ = "Print Management Console 1.0 Type Library"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\Version	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7916906-A6E9-4522-ECB9-7F04413A67DF}\VersionIndependentProgID	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B04972CD-0B4F-5207-36FF-B35A9133C4E9}\	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 1408	3908	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ImageTuner32\itpr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ImageTuner32\itpr.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 636
    3⤵
    - Program crash
    PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1408 -ip 1408
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-1-0x0000000000F80000-0x0000000000FE0000-memory.dmp

Download

memory/1408-9-0x0000000003CC0000-0x0000000003CC1000-memory.dmp

Download

memory/1408-10-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Download

memory/1408-8-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Download

memory/1408-7-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

Download

memory/1408-6-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Download

memory/1408-5-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Download

memory/1408-4-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Download

memory/1408-3-0x0000000002D20000-0x0000000002D21000-memory.dmp

Download

memory/1408-2-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Download

memory/1408-0-0x0000000000400000-0x0000000000517000-memory.dmp

Download

memory/1408-13-0x0000000000F80000-0x0000000000FE0000-memory.dmp

Download

memory/1408-12-0x0000000000400000-0x0000000000517000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads