d592c5fb14674da1c68064f14c4f295a032c083423ee091f736f78b0791de583

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d592c5fb14674da1c68064f14c4f295a032c083423ee091f736f78b0791de583.dll
Size 818KB
Sample260706-m4felsd13t
SHA256 d592c5fb14674da1c68064f14c4f295a032c083423ee091f736f78b0791de583
MD5 31de4ededefc5401100302ed971cd0f3
SHA1 b3fd29499ea9b9379d83da1a2accbcebc7ce043f
SHA512 65751f2cc3d1eef007a811d0c2c475462692b2ae8baffdc66a77ca5a85db64cd34e581d29f9597d9e470d8d6c39909546d5577656bfd2c440db929d9883c3dda
SSDEEP 12288:I27WPqmXmXVrnHbNk++NBTQeqgdYSWfj9phAqcdbPsonc5Pa:I2WbXmF/L+NBTQm2lBPx4bEN5Pa
TLSH
T12C057D2276E98035F1BF0A715A39A6554A7ABC314FB1C08F73D0AA4E3D71EC1D626723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5444 wrote to memory of 6540	5444	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d592c5fb14674da1c68064f14c4f295a032c083423ee091f736f78b0791de583.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d592c5fb14674da1c68064f14c4f295a032c083423ee091f736f78b0791de583.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6540-0-0x0000000010000000-0x00000000100DA000-memory.dmp

Download