96c443193bad8794ebf04738566e092f8b34ae4541cb2433fd0708d49edbe8fe

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.42.20062026 +HD Launcher/dxwrapper.dll
Size 1.9MB
Sample260627-ej488sgw71
SHA256 96c443193bad8794ebf04738566e092f8b34ae4541cb2433fd0708d49edbe8fe
MD5 8c3d056251f0c86a95625d4eecba8c36
SHA1 170af4dee95bbc990a4fcb34f2864b3d9fe9dc1f
SHA512 78a047f834247f1c1e3634d62d041d889cdd88f29a69ea801069fa3cdfce9dbfabe6f2579fbb037d4df4fd5f881fa87eb6855f9d83f54057c1e64d8871b296f6
SSDEEP 24576:Wx7bGAH+h16PrZGt3Q38vrRLO54wP77P0vy:idrv38vrRLe4wPMvy
TLSH
T165959E113283C13AF94A1234CD382BBE9A1DCA75176410CBBBE465AE7D752D32B3562F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2596	regsvr32.exe
2596	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2596	4916	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\1.42.20062026 +HD Launcher\dxwrapper.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\1.42.20062026 +HD Launcher\dxwrapper.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads