Resubmissions
11/05/2026, 17:21
260511-vxfe2afw5z511/05/2026, 17:10
260511-vpp99say4m511/05/2026, 16:45
260511-t9cz1aez6s5Analysis
- max time kernel
298s - max time network
214s - platform
windows10-2004_x64 - resource
win10v2004-20250619-es - resource tags
- submitted
11/05/2026, 17:10
General
- Target libvlccore.dll
- Size 38.2MB
- Sample260511-vpp99say4m
- SHA256 4b66745f3fc4e118ae198f6b0152915a72be9c9d9b5a75bf8a2779d041574ff1
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlccore.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlccore.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 6723⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1316 -ip 13161⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1316-0-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-1-0x000000007F1B0000-0x000000007F1B1000-memory.dmp
memory/1316-15-0x000000007F1B0000-0x000000007F1B1000-memory.dmp
memory/1316-11-0x000000007F1B0000-0x000000007F1B1000-memory.dmp
memory/1316-9-0x000000007F1B0000-0x000000007F1B1000-memory.dmp
memory/1316-7-0x000000007F1B0000-0x000000007F1B1000-memory.dmp
memory/1316-4-0x000000007F1B0000-0x000000007F1B1000-memory.dmp
memory/1316-6-0x000000007F1B0000-0x000000007F1B1000-memory.dmp
memory/1316-23-0x000000007F1B0000-0x000000007F1B1000-memory.dmp
memory/1316-888-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/1316-921-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
memory/1316-920-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
memory/1316-919-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
memory/1316-918-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/1316-917-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/1316-916-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/1316-915-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/1316-914-0x0000000002C70000-0x0000000002C71000-memory.dmp
memory/1316-913-0x0000000002C70000-0x0000000002C71000-memory.dmp
memory/1316-912-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/1316-911-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/1316-910-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/1316-909-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/1316-908-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/1316-907-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/1316-906-0x0000000002C30000-0x0000000002C31000-memory.dmp
memory/1316-905-0x0000000002C30000-0x0000000002C31000-memory.dmp
memory/1316-904-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/1316-903-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/1316-902-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/1316-1096-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-1074-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-1407-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-1489-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-1415-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-1414-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-1381-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-1358-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-1331-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-901-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/1316-900-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/1316-899-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/1316-898-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/1316-897-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/1316-896-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/1316-895-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/1316-894-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/1316-893-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/1316-892-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/1316-891-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/1316-890-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/1316-889-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/1316-887-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/1316-886-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/1316-885-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/1316-884-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/1316-883-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/1316-882-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/1316-881-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/1316-880-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/1316-879-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/1316-878-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/1316-877-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/1316-876-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/1316-875-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/1316-874-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/1316-873-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/1316-872-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/1316-871-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/1316-870-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/1316-869-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/1316-868-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/1316-867-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/1316-862-0x000000007F340000-0x000000007F345000-memory.dmp
memory/1316-1867-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-2187-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-3143-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-2631-0x0000000000CC0000-0x0000000000D18000-memory.dmp
memory/1316-3555-0x0000000000CC0000-0x0000000000D18000-memory.dmp