df0c1e8aa777e21c61bbc5012c4aa71e968f3430a7d63a6ef36959d4d255ce35

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df0c1e8aa777e21c61bbc5012c4aa71e968f3430a7d63a6ef36959d4d255ce35.dll
Size 2.6MB
Sample260528-ee4rxaez7m
SHA256 df0c1e8aa777e21c61bbc5012c4aa71e968f3430a7d63a6ef36959d4d255ce35
MD5 280761361e01c4c2bac970252396d121
SHA1 6a62081acc4c5e03760736eae2475a2b0dad9157
SHA512 0697ea28cef027d71c1f29e10c73f43b0f7d17568b3d39c3e10888bc586ce9456c3b8ec52c29693c07df4aec8cd088d22f97acc5924f147823a67a16abcc5f5b
SSDEEP 49152://HaG4fY77kt4GJeyjMGuJKw9G39SwbL3clRcAbe90V6Kzxr8r:36G4gnkt4GJeywGusSWbERbe90VBxr
TLSH
T144D5AE23F4438965C68E0B3945B37B350A786D29EF368B5B2294FE157D733D0A3262C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4672	3660	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3660	rundll32.exe
3660	rundll32.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3660	3716	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df0c1e8aa777e21c61bbc5012c4aa71e968f3430a7d63a6ef36959d4d255ce35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df0c1e8aa777e21c61bbc5012c4aa71e968f3430a7d63a6ef36959d4d255ce35.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 792
    3⤵
    - Program crash
    PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3660 -ip 3660
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

°ÔÍõ.ini

Path C:\Users\Admin\Desktop\°ÔÍõ.ini
Size 510B
SHA256 2319a5e02e233353501e5aecc98ef595fcd62e606a18f464702fb0ef3928d4f3
MD5 9cb7c3d71de89d001657f1a0c705498d
SHA1 485359d4cf5198382293fd71b26520bd94b5c39f
SHA512 701ab468ddc8fd502f748e5be5de3a1724aa9b78b9b55553cac3a00d817d75cce762b421d02b5ad0bdaba5ea6f51f82d3147b7e940160b258fbe13d388a3af13
TLSH
T1D1F0D485019A818F7EF9E009F4745BA8D7DD307192D4D57510FEB9C64D10A3CC65DB21
MD5 SHA1 SHA512 TLSH

Submit Download

°ÔÍõ.ini

Path C:\Users\Admin\Desktop\°ÔÍõ.ini
Size 534B
SHA256 c10b2bbad137bf57feed1b8ad08f7d2bc4ab60105d690b0e68cb9cff8a821ec6
MD5 ba13f4bc4a289e5a5da7cef900ed3340
SHA1 ccab5e628d5d67c00b5ffd2f3e46de618919ada7
SHA512 bc046019970ca574e26062ddd31bce2498ab5c31de2c51375c6c5dca06de88f85a69f36a3de7946b34e79c6a9107556cabdb2ff206b0fd3eb0d908bd70b19524
TLSH
T1CEF00E85019A818E7EF9F409B4305AA8D7DE303292C4D07810FEB9C64D10A3C866CB31
MD5 SHA1 SHA512 TLSH

Submit Download

°ÔÍõ.ini

Path C:\Users\Admin\Desktop\°ÔÍõ.ini
Size 148B
SHA256 5820971a91451e4fd80fd2ebd8ded3b419626e69c74dbea62d0820ab05edb3b8
MD5 78559d9463ed7fcaf1113d4da2cae8be
SHA1 b53ffaf265a1aa50fc0b1065f36f8ebbd468218c
SHA512 96f2ad3d962d7415d04136de3a6f8999ddcc51d2fc41a081d24bb815e8d31750729430b8a7c86b1719d992f15e91d38984b62a603f6329911c03bca12c7f6488
TLSH
T12BC02BE002C0404CF55E702CB0606B94C6FE752340E1CB700090BA914D1484C9A54D14
MD5 SHA1 SHA512 TLSH

Submit Download