21a9a74fd631030981cdca42ab580f5aa030068ab80c183b73e99bea2d4f7708

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/nsNiuniuSkin.dll
Size 288KB
Sample260427-h1mmasds91
SHA256 21a9a74fd631030981cdca42ab580f5aa030068ab80c183b73e99bea2d4f7708
MD5 1e88afb7fe5b58d09d8a1b631e442538
SHA1 9ddb655cb32d002f68bdee962ce917002faa3614
SHA512 a7723bd73f55a716ea450f075d7a4fc7cd2080992c56ad67b6d46fdf4e30cef386068e1f4c2c788764cb092b529589cc1119ea2d62d07e32ea6d201e3afaf876
SSDEEP 6144:kczmqW3rkWU6nSS0Jrco7Wj5ssBE9O8A2Bce5LX7kgvrRT2RMw7sN:kMZWQWU6ntcRvWgO8AhgX7kgzRT2BwN
TLSH
T1095423EAD46BC065CBF85E79EDC7008378B6C3193AE1C04E012EC5486E697925BB953F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral14/memory/4220-0-0x0000000074F30000-0x0000000074FEC000-memory.dmp	upx
behavioral14/memory/4220-1-0x0000000074F30000-0x0000000074FEC000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	4220	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4220	2400	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsNiuniuSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsNiuniuSkin.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 548
    3⤵
    - Program crash
    PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4220 -ip 4220
1⤵
PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4220-0-0x0000000074F30000-0x0000000074FEC000-memory.dmp

Download

memory/4220-1-0x0000000074F30000-0x0000000074FEC000-memory.dmp