23c691a2d011a71b1749464e7840bda89ed4f8c54d5e707b07e79188d76f5a96

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
23c691a2d011a71b1749464e7840bda89ed4f8c54d5e707b07e79188d76f5a96.dll
Size 2.8MB
Sample260803-bdmkfsvhmg
SHA256 23c691a2d011a71b1749464e7840bda89ed4f8c54d5e707b07e79188d76f5a96
MD5 05a4c5f59055a684cfd280c934c62f3f
SHA1 ab17a1e5cbdde26d0bcd2251b229494643d3727b
SHA512 5ede38616810743614e6b669c5f8aa68832e928427f2855d8f0e1410af91d08626f3c6ce2f9bfae0c8ac05797015830b694eb38fe9c92fe8adcdea3117fd651b
SSDEEP 49152:fZAyIrdGMpjUatfQm6UFxyxlTbu9g8p+fa3rLA6s+/T8w/2A9Sx54w:xAy9MpIazrUip0a3X5N
TLSH
T108D57E137265C021C4990132532EB73F54B86FB11FF299CB67C4BBA95AF09C19A39F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	5636	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5636	rundll32.exe
5636	rundll32.exe
5636	rundll32.exe
5636	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 5636	4168	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23c691a2d011a71b1749464e7840bda89ed4f8c54d5e707b07e79188d76f5a96.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23c691a2d011a71b1749464e7840bda89ed4f8c54d5e707b07e79188d76f5a96.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 676
    3⤵
    - Program crash
    PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5636 -ip 5636
1⤵
PID:6088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads