67cdaaf26d342b3f2a2a84ea6f7474ac43340711675b66edef34cc3fcee1ea8f

Analysis

max time kernel
598s
max time network
416s
platform
windows11-21h2_x64
resource
win11-20260130-es
resource tags

arch:x64arch:x86image:win11-20260130-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Engine/$R1/32/windhawk.dll
Size 905KB
Sample260420-jph1eact2k
SHA256 67cdaaf26d342b3f2a2a84ea6f7474ac43340711675b66edef34cc3fcee1ea8f
MD5 f7bb000645c99f89ff38c6f7616c205f
SHA1 4f76a9b030ecb1b9b9861e5be2787f63e78c0723
SHA512 33623281a35d29ee18d59fc9d286b9c83903d781b5634d4d9fc7918cc5b74027cb2d9f6fd8ecf35391c201549068d1898cada742c6947c00bfc9cbb91c1ee6e7
SSDEEP 12288:vPtFKXRL67yB1dEQ3d6GHBKLP+M+sWe1NUtcpNd+5w6uZNZcLpixp:3tRI1dvBOWM+sWeDww6uXZcLpixp
TLSH
T132153A72EE41B433ED3419345DA6076B663E91A0976281C7278C293E5DD1BD02F32FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3276	1944	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Engine\$R1\32\windhawk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Engine\$R1\32\windhawk.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3276-0-0x00000000007D0000-0x000000000088B000-memory.dmp

Download