acf366f942afb53c1f8af69d9ebd3ffe6600b6326ff3e1402bafe63d80ed3fc7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
acf366f942afb53c1f8af69d9ebd3ffe6600b6326ff3e1402bafe63d80ed3fc7.dll
Size 4.9MB
Sample260706-wlkfaaay31
SHA256 acf366f942afb53c1f8af69d9ebd3ffe6600b6326ff3e1402bafe63d80ed3fc7
MD5 cd7269c45abe0ffb347c0e649f88f63f
SHA1 10649063402d3b3d03815a2e392390fb21d77b18
SHA512 74701ef3f1460803cd8c73b19f31b460da4d7bdf8cfbbcba84f53c04c30e12978ae14b621d18c36544dd432ffc41b5dd12ec06f70e5c9683ad57e7aaf8000a33
SSDEEP 98304:i4+h/1sFwqdikEyMlN8urukU5mU5YrDwZ9p1Xtsf:p/iqQl7rukIvn1Xtsf
TLSH
T15736E013B7D080B2E5AF017625679B3A9B7AB6110724C9C3A7D01E4D2F716D1BA3E34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2808	rundll32.exe
9	2808	rundll32.exe
10	2808	rundll32.exe
11	2808	rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	2808	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "bc9048413b3351fa537073e66036bfd3"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "fgsacpf8utjygjeertuxqx7vtkmm"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 2808	3676	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acf366f942afb53c1f8af69d9ebd3ffe6600b6326ff3e1402bafe63d80ed3fc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acf366f942afb53c1f8af69d9ebd3ffe6600b6326ff3e1402bafe63d80ed3fc7.dll,#1
  2⤵
  - Badlisted process makes network request
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1056
    3⤵
    - Program crash
    PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2808 -ip 2808
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2808-0-0x0000000010000000-0x00000000103BB000-memory.dmp

Download