78bed36340918a9c4893646a8a0432b901b6734aa1880eb47675ae4f47f79c12

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 04:37

Target
78bed36340918a9c4893646a8a0432b901b6734aa1880eb47675ae4f47f79c12.dll
Size 103KB
Sample260707-e9a33sez7l
SHA256 78bed36340918a9c4893646a8a0432b901b6734aa1880eb47675ae4f47f79c12
MD5 b316d7abee3096ba7e0fdb6c0c08dc0b
SHA1 566875c1a10de7136e743d03e60ed28bf3bdd653
SHA512 22a95dabb4c38a223e69c8b28d5a38b59127c8a60e639224a784037a7396e226ff8a9a40ae85087686205380476a0b9fb13ea711901b365d84f6174940db2bf7
SSDEEP 3072:D4ygknsQdPJSiybY1VhtboxT7dzTIiymO3qz7De:Ud9IhybY1lbyvGBbaz
TLSH
T13CA302677AFD872AD22FD2B0953A708D65716D240954C3CBA57123FF5CEBAD2C0921D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3480	4792	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78bed36340918a9c4893646a8a0432b901b6734aa1880eb47675ae4f47f79c12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78bed36340918a9c4893646a8a0432b901b6734aa1880eb47675ae4f47f79c12.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3480

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3480-0-0x0000000010000000-0x0000000010079000-memory.dmp

Download