00613efa358764930353232f3442ebb934506051cd7d4eec545e2da35aa8546c

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/downloader_easeus/2.0.0/2ad_google_trial/aliyun/api-ms-win-core-file-l1-1-0.dll
Size 21KB
Sample260508-pgldfsb17k
SHA256 00613efa358764930353232f3442ebb934506051cd7d4eec545e2da35aa8546c
MD5 b5a9fab8a1fe14f47f953fb58b648fc8
SHA1 a374cbb6d4b1dcadfabc2c3f7e7183e0472212be
SHA512 afb668de538c2478202d16c3e877a4107d46a03a102c2c5d692c87bdcf904e9763869a3e317cac214d8e4140d65123c1f52928db4c826dd4cbcc11be86a40b99
SSDEEP 384:+CPvVX3W5hWuR4Zq0GftpBjRj3Z5ZjVlGizJv:+CPvVXml47iXj3Z5VxV
TLSH
T1C2A21983C9B8E647FCCF9E7122A5D9837C3983C20824548616A9E6DD3CD33C6E79895C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	4708	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4708	4684	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\2.0.0\2ad_google_trial\aliyun\api-ms-win-core-file-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\2.0.0\2ad_google_trial\aliyun\api-ms-win-core-file-l1-1-0.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 600
    3⤵
    - Program crash
    PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4708 -ip 4708
1⤵
PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4708-0-0x0000000000F60000-0x0000000000F79000-memory.dmp

Download