60c81f465706d5a6f8e7675c07d881e77946186ca87d401af8ab82c6baa6a7ac

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
python312x32/_decimal.dll
Size 241KB
Sample260729-pmc92awthy
SHA256 60c81f465706d5a6f8e7675c07d881e77946186ca87d401af8ab82c6baa6a7ac
MD5 1b8b989b35370db8d0e735c5012daff1
SHA1 f11ed616cd2245ac213b785c82ecc58d89d78c78
SHA512 213b09b133882bcdee9b9cad53ea1ecc97e8b89e789c89f10b7e8dee76e5ced13d9c4b429aef2ee650b7dbd7b289656755f6164d3ba501a63cd92f6b7fcf1de7
SSDEEP 6144:iWbSfCk63qYiVoGc+CMF0ggx/rSCSmc9q2a23ArW1gcf8mWfZovpdVt:iWbSfCk63qYiVTcrMFHgxDSuwHJcAdVt
TLSH
T1DB344A11F999C83AF8E000F096AF49FB55BC5474435A85CBE6951C41AEC25E3E2BF3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4168	3508	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3508	4128	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\python312x32\_decimal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\python312x32\_decimal.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 628
    3⤵
    - Program crash
    PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3508 -ip 3508
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads