f9f5cee06b22ba784a5ff19efc5710a0a6284f4b1a6de35e100c6683ac2ea422

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9f5cee06b22ba784a5ff19efc5710a0a6284f4b1a6de35e100c6683ac2ea422.dll
Size 124KB
Sample260701-pmkdcaf17v
SHA256 f9f5cee06b22ba784a5ff19efc5710a0a6284f4b1a6de35e100c6683ac2ea422
MD5 1afbafe3e688b478db471804138bdd3e
SHA1 7b96364b5e0d76b093cae143e7502d3435755aee
SHA512 1a57a6f36c10e97d020570a9a205c53ad30b58898e62f7f0ff2c7f5b41f092360450f7622dd2f01b33b0f0fc0864d2d96803faccd2d9cab4d5344722c862daec
SSDEEP 1536:A2V9GH/ce8EOgLH4WPZWlxCaC9aMA3j25ykpgWB31hTp2Js+sP6f:AmEZ8EvzlexgkMd9pgWBllp2VsP6
TLSH
T1D9C3BFC2C1A47931F81BD33A05332CD09EBA6FAC914297BA99D1BC0E29737166537D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2824-0-0x0000000074780000-0x00000000747DF000-memory.dmp	upx
behavioral2/memory/2824-2-0x0000000074780000-0x00000000747DF000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2824	1784	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9f5cee06b22ba784a5ff19efc5710a0a6284f4b1a6de35e100c6683ac2ea422.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9f5cee06b22ba784a5ff19efc5710a0a6284f4b1a6de35e100c6683ac2ea422.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-0-0x0000000074780000-0x00000000747DF000-memory.dmp

Download

memory/2824-2-0x0000000074780000-0x00000000747DF000-memory.dmp