b41f51d7b8fd23fc2549dc587228b7d78dbf8f85ae66d744c6546aee801dcfa0

Analysis

user interaction
yes
max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:33

Target
oc32.dll
Size 681KB
Sample260730-2grxfs1yev
SHA256 b41f51d7b8fd23fc2549dc587228b7d78dbf8f85ae66d744c6546aee801dcfa0
MD5 1ddd1f8bc6bdccc121499d5fa43a0427
SHA1 28997a9a5d6dc7f5f7250909b4ec996dd370e519
SHA512 ccb0bd50bb712029312fd1a7a49144ba7ff0b8327f93095d3340f4a392a6fd04fe326d516ac4efbfe130bb354854d1d3dfdbb2702e57c290eec6f3746c00cbe0
SSDEEP 12288:pS+G2WqAXKk/eSSSSSSSF9w5Ij7Opzzxpk:pS+LWqCKk/s5IjenD
TLSH
T1E3E4E618BB40C16FD82C657708AABBBD337DA844AE6187DB7369B37F1C251C81D185AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 3944	1864	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\oc32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\oc32.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3944

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3944-2-0x0000000003F40000-0x0000000003FA9000-memory.dmp

Download