bfb444c37dfd9e32d03e68ae9f3b8f941f75ad0c9698786315ca39148dbdecc9

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ConquerCipherHook.dll
Size 133KB
Sample260730-g8wphasbnh
SHA256 bfb444c37dfd9e32d03e68ae9f3b8f941f75ad0c9698786315ca39148dbdecc9
MD5 86a6ad0e61d933736384b497574643d3
SHA1 aa6fec4b699a38c882fa6c60aec796977d480897
SHA512 c43c62a70925fa09bb347adbe74fff307fb76792bb0b230d2e32c843a2172ff5e24143a72d79cae94cd8289a56e28990d17f31a6e3e7253e9d620c42f1b6995d
SSDEEP 1536:WJQUU83HlXFwoBjwmrEBF6xm4+RtyzUTs42Ug/wD1cfRmh:WJuiZ9B0mABF6s4C86sBUg/wDyg
TLSH
T198D34A6CFE4314F2F22710F4088ED7BA413636068637AEB7EF4AD656BE72B51190521E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ConquerCipherHook.log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5456	5068	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 5068	5500	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConquerCipherHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConquerCipherHook.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 508
    3⤵
    - Program crash
    PID:5456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5068 -ip 5068
1⤵
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ConquerCipherHook.log

Path C:\Windows\SysWOW64\ConquerCipherHook.log
Size 224B
SHA256 e4447d33e59bfb1d34f73efa0433966aff79269dcee2a665abfa9fa769a89316
MD5 5dfb02bc1d49f8b2c0d32ad119b15d39
SHA1 08c59c7fc04c8cf56ab43e7b1180d975ee016033
SHA512 ba51f17d54aa0943984a5946aec08e794395614f33dae3c05e32b3a3f4de944d356af903a3f7841142b938bd198244fcc234190b2dbe1c4b75c05bb9ae316859
TLSH
T121D0A7AC168511FC7C04A121722B02F8B07BB2546B5172380091865DA51043C0E2F8CC
MD5 SHA1 SHA512 TLSH

Submit Download