1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318

Analysis

max time kernel
149s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318.dll
Size 249KB
Sample260508-ecdspsgt2n
SHA256 1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318
MD5 2858cacaefbd5fa5f27263843ae93e52
SHA1 f069e0709b6a486a7b668ed30ef736e2902ba778
SHA512 153427dd3927e7e50d883ae1ec73eb8913d9a39c1485e84f9dd0cd3ad6a90a9c847c1915fedb646b23b20a82bfcbd7da5e994bbea7b879e129967fdabd618ee5
SSDEEP 3072:8ga1mcahTEIFFyUvc407DW5T54450KCJMv6bZFX+a48J9fsAjbt51vv8w5DU41pT:Y0EINc40cTC4501Mvs7Xf0mFtvPPlXJ
TLSH
T1FB442A0072D1C835F8BB1D364ABD85594A6CBD601F55ECDBA3C4191E0EBA6E1EA30E73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 3364	5496	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads