Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/07/2026, 22:33
General
- Target 4a34c03f0e85d7bc9c80230adbd920c64108d829ed75e18e0a8645e97c7f5614.dll
- Size 4.1MB
- Sample260709-2gm89sat7k
- SHA256 4a34c03f0e85d7bc9c80230adbd920c64108d829ed75e18e0a8645e97c7f5614
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a34c03f0e85d7bc9c80230adbd920c64108d829ed75e18e0a8645e97c7f5614.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a34c03f0e85d7bc9c80230adbd920c64108d829ed75e18e0a8645e97c7f5614.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3700-25-0x0000000071A20000-0x0000000071A25000-memory.dmp
memory/3700-28-0x00000000719E0000-0x00000000719E2000-memory.dmp
memory/3700-50-0x0000000071930000-0x0000000071935000-memory.dmp
memory/3700-60-0x00000000718D0000-0x00000000718D5000-memory.dmp
memory/3700-57-0x00000000718C0000-0x00000000718C2000-memory.dmp
memory/3700-55-0x0000000071900000-0x0000000071905000-memory.dmp
memory/3700-52-0x00000000718F0000-0x00000000718F2000-memory.dmp
memory/3700-47-0x0000000071920000-0x0000000071922000-memory.dmp
memory/3700-45-0x0000000071960000-0x0000000071965000-memory.dmp
memory/3700-40-0x0000000071990000-0x0000000071995000-memory.dmp
memory/3700-38-0x0000000071980000-0x0000000071982000-memory.dmp
memory/3700-35-0x00000000719C0000-0x00000000719C5000-memory.dmp
memory/3700-32-0x00000000719B0000-0x00000000719B2000-memory.dmp
memory/3700-30-0x00000000719F0000-0x00000000719F5000-memory.dmp
memory/3700-22-0x0000000071A10000-0x0000000071A12000-memory.dmp
memory/3700-20-0x0000000071A50000-0x0000000071A55000-memory.dmp
memory/3700-15-0x0000000071A80000-0x0000000071A85000-memory.dmp
memory/3700-9-0x0000000071AC0000-0x0000000071AC1000-memory.dmp
memory/3700-3-0x0000000071AF0000-0x0000000071AF5000-memory.dmp
memory/3700-42-0x0000000071950000-0x0000000071952000-memory.dmp
memory/3700-17-0x0000000071A40000-0x0000000071A42000-memory.dmp
memory/3700-12-0x0000000071A70000-0x0000000071A72000-memory.dmp
memory/3700-10-0x0000000071AB0000-0x0000000071AB5000-memory.dmp
memory/3700-6-0x0000000071AA0000-0x0000000071AA2000-memory.dmp
memory/3700-5-0x0000000071AC0000-0x0000000071AC1000-memory.dmp
memory/3700-2-0x0000000071AD0000-0x0000000071AD1000-memory.dmp
memory/3700-0-0x0000000071AE0000-0x0000000071AE2000-memory.dmp