1c0a5b16e973ca71bae096b4f83e7b68719061eb3b8dc17fbfd756dfc7c7ecf0

Analysis

user interaction
yes
max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/api-ms-win-crt-math-l1-1-0.dll
Size 29KB
Sample260508-aramdafv7k
SHA256 1c0a5b16e973ca71bae096b4f83e7b68719061eb3b8dc17fbfd756dfc7c7ecf0
MD5 7aa6e989cd868ca3b7d334f2e8ea91a2
SHA1 f9a3f3a33abb33be79bac88d98bcbcc9112b34bd
SHA512 61d31e5882f6b263f1389facfe08bcb10b65838105ba0acf64c277a80b524ced485bdb43918931909fb395abb653ac0fb74fe2ec742260580afd043d33c04daf
SSDEEP 384:p47isbM4Oe5grykfIgTmLKWEhWsc6A0GftpBjOsERHRN7JU7l5AlZ0:G1Mq5grxfInoDiAsEBWAM
TLSH
T159D2C88789ECBF63E9CB0BB311F4CBCA6A38579154E175B4D887A0C834923C47E57918
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 5764	5776	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\api-ms-win-crt-math-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\api-ms-win-crt-math-l1-1-0.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5764-0-0x0000000001F00000-0x0000000001FD3000-memory.dmp

Download