c04668ac868f6acb1ffede91ca6f7c3513f943d6674bd483acc51c671f88b926

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c04668ac868f6acb1ffede91ca6f7c3513f943d6674bd483acc51c671f88b926.dll
Size 32KB
Sample260527-vlk65sfx21
SHA256 c04668ac868f6acb1ffede91ca6f7c3513f943d6674bd483acc51c671f88b926
MD5 b14e9e98c0f739c01788e0b477531f15
SHA1 81a870bac2f8e100aa1fcc27cb6a61d53a08b5b2
SHA512 f8cdb164d6ad16bd9f3092a46c0985b13cd1aea0635eff40069c91e59a62a29c9c81f3d17df576c5c27a3ab0a67020ae74e68027a0fe6d7cc6ce04a6cfc14130
SSDEEP 768:Hlf8KqUfxaMEXVIj8Dq8ywHq90Hl25Y1m5UA2cWFGbxJbPrKSYH0t:HlDzDEFe8gWF67
TLSH
T1B9E2F7E8FA494CBBD43AEC3646AC6C05C775791A85D2F3C260F689A36D3B6400F49F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 5932	1912	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c04668ac868f6acb1ffede91ca6f7c3513f943d6674bd483acc51c671f88b926.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c04668ac868f6acb1ffede91ca6f7c3513f943d6674bd483acc51c671f88b926.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5932-0-0x0000000000B10000-0x0000000000B27000-memory.dmp

Download