1e098c7f70d30c48cd01c73805bd299a0c131a48af2dd29d1753271ae90661e9

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libs/libspeex.dll
Size 372KB
Sample260522-daa4csfy2t
SHA256 1e098c7f70d30c48cd01c73805bd299a0c131a48af2dd29d1753271ae90661e9
MD5 b98bded4709e3718bc99d05a21fd078a
SHA1 75ba87d44bd922be5bcf6721f035dabfa6338490
SHA512 a26ce188e3d05366db85d67462995369794e3baece302463eede19c8037b66d851507dc8c86bc512567cdecacf05e1746b9c108a5cbc5215fba75734e9a8c2aa
SSDEEP 6144:nGYIxae9LdACl7xZjYLwToaS90T1ZiQ9pICYSnf3TorJw/PIj98YB:OaeUYT0soaS9G+SfkiHIuYB
TLSH
T1A4847C89F7D79EE7D91113329EEB872E1738D3845A139B5B5A24E2342D033E39E89704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3720	1196	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 1196	3096	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libs\libspeex.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libs\libspeex.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 456
    3⤵
    - Program crash
    PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1196 -ip 1196
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x0000000069780000-0x00000000697DC000-memory.dmp

Download