29c12b50516222fd92fc5538c0f2b8f78489d2a696a73ec370465119e8128126

Analysis

max time kernel
899s
max time network
495s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run_default_rundll32.cmd
Size 72B
Sample260702-dmw7csbt91
SHA256 29c12b50516222fd92fc5538c0f2b8f78489d2a696a73ec370465119e8128126
MD5 3b6074d10acb338a13d49f85b7afe7fb
SHA1 6440fb38bbc08b0070ddc4903e122bcc787ab03d
SHA512 9d47d3f9e9ed0cf421c1c4f37b541862d7443ab59f32a76456d8555c4e007ba5ff12c3b7b04d443cd2c94bd609ecae33a6b1d10df0ed9eeb9613beed8797a216
TLSH
T175A0220320CB0202A000A0300C3230B8003EE00BAA0A8AE02800C2323EAE20382280C2
MD5 SHA1 SHA512 TLSH

Score

5^/10

defense_evasion discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
920	rundll32.exe
920	rundll32.exe
920	rundll32.exe
920	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2476	timeout.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 4636	672	cmd.exe	89
PID 4636 wrote to memory of 920	4636	rundll32.exe	90
PID 672 wrote to memory of 2476	672	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run_default_rundll32.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\system32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\google.cl",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\google.cl",#1
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:920
- C:\Windows\system32\timeout.exe
  timeout /t 180 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1880

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-0-0x0000000073C90000-0x0000000074967000-memory.dmp

Download

memory/920-1-0x0000000073F1A000-0x0000000074689000-memory.dmp