Resubmissions
11/05/2026, 17:21
260511-vxfe2afw5z511/05/2026, 17:10
260511-vpp99say4m511/05/2026, 16:45
260511-t9cz1aez6s5Analysis
- max time kernel
298s - max time network
214s - platform
windows11-21h2_x64 - resource
win11-20250610-es - resource tags
- submitted
11/05/2026, 17:10
General
- Target libvlccore.dll
- Size 38.2MB
- Sample260511-vpp99say4m
- SHA256 4b66745f3fc4e118ae198f6b0152915a72be9c9d9b5a75bf8a2779d041574ff1
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlccore.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libvlccore.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 5443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4452 -ip 44521⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4452-0-0x0000000002F00000-0x0000000002F58000-memory.dmp
memory/4452-1-0x000000007FB50000-0x000000007FB51000-memory.dmp
memory/4452-15-0x000000007FB50000-0x000000007FB51000-memory.dmp
memory/4452-11-0x000000007FB50000-0x000000007FB51000-memory.dmp
memory/4452-9-0x000000007FB50000-0x000000007FB51000-memory.dmp
memory/4452-7-0x000000007FB50000-0x000000007FB51000-memory.dmp
memory/4452-6-0x000000007FB50000-0x000000007FB51000-memory.dmp
memory/4452-4-0x000000007FB50000-0x000000007FB51000-memory.dmp
memory/4452-23-0x000000007FB50000-0x000000007FB51000-memory.dmp
memory/4452-682-0x000000007FCE0000-0x000000007FCE5000-memory.dmp
memory/4452-715-0x0000000003560000-0x0000000003561000-memory.dmp
memory/4452-714-0x0000000003550000-0x0000000003551000-memory.dmp
memory/4452-713-0x0000000003550000-0x0000000003551000-memory.dmp
memory/4452-712-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4452-711-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4452-710-0x0000000003530000-0x0000000003531000-memory.dmp
memory/4452-709-0x0000000003530000-0x0000000003531000-memory.dmp
memory/4452-708-0x0000000003520000-0x0000000003521000-memory.dmp
memory/4452-707-0x0000000003520000-0x0000000003521000-memory.dmp
memory/4452-706-0x0000000003510000-0x0000000003511000-memory.dmp
memory/4452-705-0x0000000003510000-0x0000000003511000-memory.dmp
memory/4452-704-0x0000000003500000-0x0000000003501000-memory.dmp
memory/4452-703-0x0000000003500000-0x0000000003501000-memory.dmp
memory/4452-702-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/4452-701-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/4452-700-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/4452-699-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/4452-698-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/4452-697-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/4452-696-0x00000000034C0000-0x00000000034C1000-memory.dmp
memory/4452-695-0x00000000034C0000-0x00000000034C1000-memory.dmp
memory/4452-694-0x00000000034A0000-0x00000000034A1000-memory.dmp
memory/4452-693-0x00000000034A0000-0x00000000034A1000-memory.dmp
memory/4452-692-0x0000000003490000-0x0000000003491000-memory.dmp
memory/4452-691-0x0000000003490000-0x0000000003491000-memory.dmp
memory/4452-690-0x0000000003480000-0x0000000003481000-memory.dmp
memory/4452-689-0x0000000003480000-0x0000000003481000-memory.dmp
memory/4452-688-0x0000000003470000-0x0000000003471000-memory.dmp
memory/4452-687-0x0000000003470000-0x0000000003471000-memory.dmp
memory/4452-733-0x00000000035F0000-0x00000000035F1000-memory.dmp
memory/4452-1123-0x0000000002F00000-0x0000000002F58000-memory.dmp
memory/4452-741-0x0000000003630000-0x0000000003631000-memory.dmp
memory/4452-740-0x0000000003620000-0x0000000003621000-memory.dmp
memory/4452-1685-0x0000000002F00000-0x0000000002F58000-memory.dmp
memory/4452-1254-0x0000000002F00000-0x0000000002F58000-memory.dmp
memory/4452-739-0x0000000003620000-0x0000000003621000-memory.dmp
memory/4452-738-0x0000000003610000-0x0000000003611000-memory.dmp
memory/4452-737-0x0000000003610000-0x0000000003611000-memory.dmp
memory/4452-736-0x0000000003600000-0x0000000003601000-memory.dmp
memory/4452-735-0x0000000003600000-0x0000000003601000-memory.dmp
memory/4452-734-0x00000000035F0000-0x00000000035F1000-memory.dmp
memory/4452-732-0x00000000035E0000-0x00000000035E1000-memory.dmp
memory/4452-731-0x00000000035E0000-0x00000000035E1000-memory.dmp
memory/4452-730-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4452-729-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4452-728-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/4452-727-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/4452-726-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/4452-725-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/4452-724-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/4452-723-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/4452-722-0x0000000003590000-0x0000000003591000-memory.dmp
memory/4452-721-0x0000000003590000-0x0000000003591000-memory.dmp
memory/4452-720-0x0000000003580000-0x0000000003581000-memory.dmp
memory/4452-719-0x0000000003580000-0x0000000003581000-memory.dmp
memory/4452-718-0x0000000003570000-0x0000000003571000-memory.dmp
memory/4452-717-0x0000000003570000-0x0000000003571000-memory.dmp
memory/4452-716-0x0000000003560000-0x0000000003561000-memory.dmp
memory/4452-2052-0x0000000002F00000-0x0000000002F58000-memory.dmp
memory/4452-2615-0x0000000002F00000-0x0000000002F58000-memory.dmp
memory/4452-3136-0x0000000002F00000-0x0000000002F58000-memory.dmp
memory/4452-3397-0x0000000002F00000-0x0000000002F58000-memory.dmp