9a8a003b78977d2783318c9828abe27d135b1d2182f87c0dae3bdf3b6b78661c

Resubmissions

11/05/2026, 14:16

260511-rllacsb1718

11/05/2026, 13:31

260511-qssscabs2s8

Analysis

max time kernel
298s
max time network
324s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SAP-GUI-770/system/sap/saplgmgr2.dll
Size 354KB
Sample260511-qssscabs2s
SHA256 9a8a003b78977d2783318c9828abe27d135b1d2182f87c0dae3bdf3b6b78661c
MD5 9ed83db4f3cec898a920572bd88e45e2
SHA1 f2bc484139b8b5a83e97ea27fb49bc89418a732b
SHA512 63c07b97d34b4ea14cc8ef81060ffce2d3b12f7d00ccab40d18bbddc3d2c5e8d597c17c1e973b28923c10a903ac78e572c4dfe67f8b368998b8fa38c4b1c41e1
SSDEEP 6144:MurF01MhzZWfu786ttIIGrWBCZyxrwk9Fi9C40izmHangBw4DN8lbMHsfdZLhYd3:zF01MhzZ+rVKhFiNiagBz8RFflwt
TLSH
T1527419A7EB59D83AF46F0235365C265910B4AE205BD2C1C7A3C0965E2AB79C3D43CB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	4572	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4572	4532	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\saplgmgr2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\saplgmgr2.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 736
    3⤵
    - Program crash
    PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4572 -ip 4572
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4572-0-0x0000000002060000-0x00000000020E7000-memory.dmp

Download