bb0194db4f88297238109313a18994fa102f9e0162c36cd21317cfeef7051d09

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nz.dll
Size 18KB
Sample260801-az7bbaba82
SHA256 bb0194db4f88297238109313a18994fa102f9e0162c36cd21317cfeef7051d09
MD5 d2e2fad2e4380c130b9571e5c2a2b779
SHA1 7ef8b4fbd9c704e35be31bc7bb7d087094d93ec5
SHA512 70b7b1183c61317d567347dbd935f8fdaca65e0ee46a670b1dc0bff741c7d517da89af294add173ec54322f9329560b21afc5f4118c839ae53d81b23dd2d5f7e
SSDEEP 384:t0baqgYF+GD6WDIpwKNs43b7u9kcuBsSJIVE8E9VF0NyLz:tIdF366943bYC2EZ
TLSH
T1B4824C63EE505C83CD426F7970CB996FB97CB7510B5289C35534C4388F823D625AA2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	4232	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4232	3132	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nz.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 600
    3⤵
    - Program crash
    PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4232 -ip 4232
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4232-0-0x000000006E140000-0x000000006E146000-memory.dmp

Download