8187b2726d247052ddd71877136651757ac446b0fc4fdc501a6cdacd72d51f02

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8187b2726d247052ddd71877136651757ac446b0fc4fdc501a6cdacd72d51f02.dll
Size 6.1MB
Sample260805-px92raxgrb
SHA256 8187b2726d247052ddd71877136651757ac446b0fc4fdc501a6cdacd72d51f02
MD5 152e39f7d602c79069c6799256011731
SHA1 c5877ae6a62ec7a8f196a79f55665c85a56cd521
SHA512 1d2e92a91638e56a47a4b2be3233160a21a2d8ebc4312ea30fb0c7c1da230ad5abad14a569ba3b09780d901f445b4c1a034ad0b01cb00680457851fdeec28679
SSDEEP 98304:TYj1xRPwDDYJzcSmYnn6+7AjutZJW8ktRhfJO:MjqDYuSHnnOjsY8ktRhfJ
TLSH
T1B956DF12EA5BC975C1FE003408FB665D7F3607EA873B97D39BC02A512CE26D1A8F5192
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 5872	5516	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8187b2726d247052ddd71877136651757ac446b0fc4fdc501a6cdacd72d51f02.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8187b2726d247052ddd71877136651757ac446b0fc4fdc501a6cdacd72d51f02.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5872-0-0x0000000010000000-0x0000000010614000-memory.dmp

Download