f6e015b6baceae9a243ecd701fb22dc8a66c3167b7903bda18867fc411145d57

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6e015b6baceae9a243ecd701fb22dc8a66c3167b7903bda18867fc411145d57.dll
Size 2.7MB
Sample260424-2gn6kaev4p
SHA256 f6e015b6baceae9a243ecd701fb22dc8a66c3167b7903bda18867fc411145d57
MD5 5352cea38726c90050bc19dc35942244
SHA1 8a1560dcd666354a9bcbfc5efa451d6f67ff946f
SHA512 e4742d8926dc10877a44b3f2d711ef34b8675ef975ca04541c9269157fee7db5ff205c25fd433f0daf1213e04c1803647c6b5ffc9f51254c1630919eea4f1f8e
SSDEEP 49152:jg2KzJAOdcsyawU8Fg0rGykuCb1LMtWHPGZhWvp8PoTOhM:jWfYawZhKTuSdnHPGyePo
TLSH
T106D5BF82FA878172D8D2017955FB577F6E39A7300717C9C3A7A02D74AD212E1673E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 5072	3572	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6e015b6baceae9a243ecd701fb22dc8a66c3167b7903bda18867fc411145d57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6e015b6baceae9a243ecd701fb22dc8a66c3167b7903bda18867fc411145d57.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-0-0x0000000002CC0000-0x0000000002F4B000-memory.dmp

Download