98763086c0fd7e56624e16b372e55c7096e03deb88650bc586cfeefd062c1b6a

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dvorak-keyboard/dvorak/wow64/Dvorak.dll
Size 6KB
Sample260718-11ekssd15l
SHA256 98763086c0fd7e56624e16b372e55c7096e03deb88650bc586cfeefd062c1b6a
MD5 39c7392f72703ec37d4d11b4d1a14571
SHA1 6ddc447ff386652db0183532158ca109a89dd659
SHA512 b9a47c4955d3b99c241003e7d1f8dd8c580afcf34b9e07b57b84d12a56ec26bd0a49927123b07e49c396023b18b05c51d5f42b2afcc2fca6df92eb632a9319dc
SSDEEP 48:qwg9Iw+AAgynkYIoarJMVcEjFzuyLT7N8a+q7moWhJUn6Wcu1rDE082Actqsx7Si:Uu1aKcEuyHJ8xnoW86WjVEmrd1ee
TLSH
T179D11F80DFF5813DF2FFCB3814B6662678257D2294F3CA6D1191064B58AF6409F19B39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 1528	4308	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dvorak-keyboard\dvorak\wow64\Dvorak.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dvorak-keyboard\dvorak\wow64\Dvorak.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads