53180306bad339e76cc427009db15f124f49d4c879676258264365a7e2ed703f

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_hashlib.dll
Size 46KB
Sample260501-pg7lpabs3k
SHA256 53180306bad339e76cc427009db15f124f49d4c879676258264365a7e2ed703f
MD5 303a1d7d21ca6e625950a966d17f86be
SHA1 660aaad68207dc0a4d757307ad57e86b120f2d91
SHA512 99036d59cad6f286e8f901acadcc7db192bb385699228b1b34907ea49fb5ff07b636550c04f0d4b70f161a26ea2e58794d9080d69d053ada08d2ad9bd3f861df
SSDEEP 768:kRYrG0oovQkzNCU+f/0JiAgUhID5IHuYiSyvtpPxWEHdxFAy:WYrfXvtYD/0JiAgUhID5IHu7SynPxzxT
TLSH
T176234B806A4448A2E9F600B179F5CF37AD38B77047E851E3FB97888D47214D3AB7526A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4604	4500	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_hashlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_hashlib.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4604-0-0x0000000001040000-0x00000000012C1000-memory.dmp

Download