aa5689088f05024cf280bfd172b7c7a47bb1d1e0496cc98b7a738e09c39f71c5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa5689088f05024cf280bfd172b7c7a47bb1d1e0496cc98b7a738e09c39f71c5.dll
Size 2.4MB
Sample260503-va5ready2t
SHA256 aa5689088f05024cf280bfd172b7c7a47bb1d1e0496cc98b7a738e09c39f71c5
MD5 c167608ca42dd139516bcb1c22e75750
SHA1 1177655c10753f9bb459258b463b94fe3876eb22
SHA512 1cbb9ab8342fb6eda6acda4f8c1a27de906b45a9e43ad47e21e08dbd16fcefe6c686d76ed5bdaab63dae0fa4412f091a7b95555b7e4ddf4e4479d08b3c31dcb5
SSDEEP 49152:eGGLbLrsmZu8RhIHX1cL7LU5AdvT7RRCY1ezhng7u6Dtg0wTSbLXuDD8qw:6LbMmZtIHFcLnU+dvzCUahng7u660wTt
TLSH
T130B57DA17E4040A6C12F2235F779A3F8B6BD61300FA641C75B91AE6C2D75482D7AD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 4932	2288	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa5689088f05024cf280bfd172b7c7a47bb1d1e0496cc98b7a738e09c39f71c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa5689088f05024cf280bfd172b7c7a47bb1d1e0496cc98b7a738e09c39f71c5.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads