e9a632cb71f44d99da9ea2f829ee2b45687dd0a978b9c4586e7a72ddbbd355eb

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cogmind/libvorbis-0.dll
Size 154KB
Sample260627-e7rm2sht9p
SHA256 e9a632cb71f44d99da9ea2f829ee2b45687dd0a978b9c4586e7a72ddbbd355eb
MD5 94da46fc04cccd3279a1dbfc9fbf7d53
SHA1 bb7ba067cbd621b19d21aa02398efaf02f1ec9d2
SHA512 ba4893a237f46086f5d386e87789422cae474ab01254c3106bc9a936a543f53b9d1ce7fbfd06d816bb4fb5f57e8e2a07e1d4f0b9db7db547d08e57c05be70450
SSDEEP 1536:5HYKpnDPQ1bZNcozr+hldKTOpb5nNAiIQAMIpUtpQz1iTNLPPUsXxTTLRazIxire:9pnD0CldKal5nVIhhVoJcI9RtO8
TLSH
T1D9F37D19F81290BED4F7A131508FBABFE4256B3C83608C67AF4E59F8E626F505D8E141
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5980	4572	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4572	3752	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cogmind\libvorbis-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cogmind\libvorbis-0.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 508
    3⤵
    - Program crash
    PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4572 -ip 4572
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4572-1-0x0000000070680000-0x000000007068A000-memory.dmp

Download

memory/4572-0-0x00000000750A0000-0x00000000750CE000-memory.dmp