de42b96a02b9f80c91a5586f96d80733b061907a6e0577e8e95ca8cc83fc12b0

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de42b96a02b9f80c91a5586f96d80733b061907a6e0577e8e95ca8cc83fc12b0.dll
Size 7.2MB
Sample260720-ld45lsfx4s
SHA256 de42b96a02b9f80c91a5586f96d80733b061907a6e0577e8e95ca8cc83fc12b0
MD5 e0bb1427a72fc57d012b793de38a2fc3
SHA1 527b8ea4f10677e50721904384a7be1ce1571dda
SHA512 05c1d8f88f2a5c8a4c3a9a937c5d0dd521cf02c82f238c3a838e8bdf309122c391917c74faedef9ba80325efb8a667046896872e98df52d500d39c0efd5fbb5a
SSDEEP 196608:QIst4A0YB50Pxrb4exIXLMMCNNQlNNNF:QIsPIxweFNNQlNNNF
TLSH
T13F768D21E6D09036C19BCC7D936DB7AA643A0E20577469C3EED43CF83DA12D2657A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4656	2092	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de42b96a02b9f80c91a5586f96d80733b061907a6e0577e8e95ca8cc83fc12b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de42b96a02b9f80c91a5586f96d80733b061907a6e0577e8e95ca8cc83fc12b0.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads