7bd71f103db67fbd979f6f59e0327ac2cac95fe49e9b48561e8601195f7bbdda

Analysis

max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7bd71f103db67fbd979f6f59e0327ac2cac95fe49e9b48561e8601195f7bbdda.dll
Size 93KB
Sample260506-kcgr9ady2x
SHA256 7bd71f103db67fbd979f6f59e0327ac2cac95fe49e9b48561e8601195f7bbdda
MD5 8487d873745d2ca6345a0245478db33d
SHA1 39b267cf95f51c202b5a191bb1e888e3e8aff17a
SHA512 67f625bae58d0853217583db11c4197a7d4bd1482f33a4a4e893959c04e53a15968a3f2856b4a28793def4f35fbd3aacb6b9215b4fcbee2dabbfd8a4761fefe0
SSDEEP 1536:5s4Vb4WBd3N4ORg0FguTv8DUqvCB3sWfxjcdD5276E2MNV:FVDBd3NZ5v8wOijSD527P2MT
TLSH
T12B935C20BAD2D8B5D43E193409B8C5550B6D7865DFE8ACEB6B83052A0E341D1EF30EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 6136	5904	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bd71f103db67fbd979f6f59e0327ac2cac95fe49e9b48561e8601195f7bbdda.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bd71f103db67fbd979f6f59e0327ac2cac95fe49e9b48561e8601195f7bbdda.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6136-0-0x0000000002DB0000-0x000000000303B000-memory.dmp

Download