e5843c68039035de8844708786956a07d1469f75afb92373a28d9e93bb49bbf7

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CorelLASER 2018.02/lpk.dll
Size 47KB
Sample260801-wwj79sek21
SHA256 e5843c68039035de8844708786956a07d1469f75afb92373a28d9e93bb49bbf7
MD5 08d2ae67f2007ff5f69fe3281d81412c
SHA1 642b52c34e080e902f122c420b63061298bc0c9c
SHA512 227be9db5c86156d457210f79447ca95d6f5a578bb86a10d9b4b8db0786e9109a7e340f0627383a52f1a8caf306397cbab7b4af32cd412ba22224ff66fb1affc
SSDEEP 768:lojY9PXAum/U12tZAW/BXcTjX/O8KDbZS3n6yHEojY9Po:wmXiI2tZ7XqYZmn6yH1mg
TLSH
T1CF236A57EED540F2E02600B4317B9BBA99BB4C374B1F21ABDF51CD8E2C75250F622259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1076	hrl4939.tmp
2176	xszzqt.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xszzqt.exe	hrl4939.tmp
File opened for modification	C:\Windows\SysWOW64\xszzqt.exe	hrl4939.tmp

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 4380	2176	xszzqt.exe	91

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	4380	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hrl4939.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xszzqt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1076	hrl4939.tmp
1076	hrl4939.tmp
2176	xszzqt.exe
2176	xszzqt.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2000	1084	rundll32.exe	88
PID 2000 wrote to memory of 1076	2000	rundll32.exe	89
PID 2176 wrote to memory of 4380	2176	xszzqt.exe	91
PID 2176 wrote to memory of 4380	2176	xszzqt.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CorelLASER 2018.02\lpk.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CorelLASER 2018.02\lpk.dll",#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\hrl4939.tmp
    C:\Users\Admin\AppData\Local\Temp\hrl4939.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1076

C:\Windows\SysWOW64\xszzqt.exe
C:\Windows\SysWOW64\xszzqt.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 12
    3⤵
    - Program crash
    PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4380 -ip 4380
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hrl4939.tmp

Path C:\Users\Admin\AppData\Local\Temp\hrl4939.tmp
Size 39KB
SHA256 784a89d4fb7415380425c855629364af588d1f4d7073a1a63b5205423e9cd842
MD5 1521464c25034f291d612bcbfcd0ba35
SHA1 bee68f267d7d464ebbd5d17965d2f4a57583bfba
SHA512 0d97762be596d98582f368189a86243ef58e8944dfdc500a5aba7f85bf269d294fe4b9a0e24b0b81edccb97fbcd71fc624074eed1da31ddd56903b11456abe1b
SSDEEP 768:FAum/U12tZAW/BXcTjX/O8KDbZS3n6yHEojY9Po5:1iI2tZ7XqYZmn6yH1mg5
TLSH
T13C036B47EED554F2E02600B8246FABB6D8774CB78B1F72E69F40CD8E2875610F62625C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-8-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4380-7-0x0000000000400000-0x000000000040E000-memory.dmp