67ebf0c07c1696d6f3ffa86af702ab0bf42ba2d5a7071dc9c6674f746ec573ca

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PY/_remote_debugging.dll
Size 69KB
Sample260519-mt1b2aev4n
SHA256 67ebf0c07c1696d6f3ffa86af702ab0bf42ba2d5a7071dc9c6674f746ec573ca
MD5 8d6604f8c25d7682204010efe711e35f
SHA1 515399d7ec029cb00815f44dc0992c8db98b7170
SHA512 31fda3e03bd0c900e8efd2c1e06ab5a4f92ba971741fa21314ef96234b5a3b2e8ecf8011225210fe88dcb7c7168c64a99bdc9a420566c035a10fbb5844fb2520
SSDEEP 1536:c/Y4/K944Sznk0wjkh1nhYIwEoQR9OMMy329/96fIgHPU:cQ4/q446nk90nhYIwEoQR0MKY8
TLSH
T1AE63E613C67811B5E7D1017AF160CB236D39B9361B4101C3B5BBD9A81A3D2DAEB3A7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 4532	5848	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PY\_remote_debugging.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PY\_remote_debugging.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads