Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 13:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kshwxb.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Kshwxb.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Kshwxb.dll
- Size 1.8MB
- Sample260620-qb8ggae17p
- SHA256 5ba5dbab575a73dde2dfb27e53f91512e7242e1de95aeaba69fe20f68d325421
- MD5 970ca4bcd94d691dd586e6f7031a9bd6
- SHA1 27b9ab6e1c419ad456f9ca6e2b397ed4a9dc91a2
- SHA512 153f2d0a870c95a88371faf544363730615346898a9298c856a544f677f32dcbc349207a6e84640a1967b5c553699d518f136b68c475209e79ceb6429cfd1e2c
- SSDEEP 24576:LhIYXDDJ1OCV+g/LKNzQ4NBa0LDPTeCAVrH3XPqioPt1zxVqrnLJM92RY2L1Heh5:Li4RjRCBacaJM9MYg8sbsuY
- TLSH T141955C00EFD768BAE502173268FB539B2338D8090F369BC7EA547638B9776D11836716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2932 set thread context of 3416 2932 rundll32.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe 3416 AppLaunch.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3416 AppLaunch.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5092 wrote to memory of 2932 5092 rundll32.exe 86 PID 2932 wrote to memory of 3416 2932 rundll32.exe 87 PID 2932 wrote to memory of 3416 2932 rundll32.exe 87 PID 2932 wrote to memory of 3416 2932 rundll32.exe 87 PID 2932 wrote to memory of 3416 2932 rundll32.exe 87 PID 2932 wrote to memory of 3416 2932 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Kshwxb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Kshwxb.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
-