b32cb648698f57dbb7d2af3dcd9c49757001d6dfb72566e87b0d31b9667d0136

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink_dll_x86.dll
Size 2.2MB
Sample260729-xehtjsdn6x
SHA256 b32cb648698f57dbb7d2af3dcd9c49757001d6dfb72566e87b0d31b9667d0136
MD5 b3b09ffb2e4e885e2657b42f2947c0fa
SHA1 a88e8d7b5c1d872c1763e941b01b0dcbe8709e49
SHA512 a82f235b5bffb6debae51b49a4fc730ef2fe2c491ed5a68ebdc2cc6c730be7dcfb50e678efb8181233525f74b2cde3b04f6e4a050580014c69b7af7d53539521
SSDEEP 49152:+0sdh7VKacjM0p1r0uZ0eW+pi5d4w1f+Ml:OKaKX19KeW+p21fv
TLSH
T1F7B5AF43F9D246F3C24B017091BB6B621A3CC6655725DAD3E3842CBA58613E17BBF28D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4536	5068	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clink_dll_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\clink_dll_x86.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads