Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 23:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93a8b83871462df03216f16ddcde93753c3bbdca4bd3e2223d5e5c99ee8b0598.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
93a8b83871462df03216f16ddcde93753c3bbdca4bd3e2223d5e5c99ee8b0598.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 93a8b83871462df03216f16ddcde93753c3bbdca4bd3e2223d5e5c99ee8b0598.dll
- Size 65KB
- Sample260806-29d63asgmd
- SHA256 93a8b83871462df03216f16ddcde93753c3bbdca4bd3e2223d5e5c99ee8b0598
- MD5 2adfd0fa93bd28244145d37529460a42
- SHA1 3e5936ea8799de1c4f6437198437664ac5cb536a
- SHA512 1fcb28fde3aad9b9710d209b497539d9158257b9c789f7a7d073f9e7a77c32ac74d2baf6f1901f87174f7bd6b61b7e556f0b2f280549c4c539c62e51f1c31253
- SSDEEP 768:9WJBw8yYZgRDtoQZBHn3BHqCBHscBHywBHqWBBKjBHv/BFnhBHGTBHZ1Bf3lBHao:oJ+8axDzQ3SqVaFDG
- TLSH T1F7632B06CBE95677E6F2BA300F7E8A3D1525F9058F228C1FD155812E3BB4B24AE42717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language magnify.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5316 magnify.exe 5316 magnify.exe 5316 magnify.exe 5316 magnify.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4460 wrote to memory of 2268 4460 rundll32.exe 90 PID 2268 wrote to memory of 5316 2268 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93a8b83871462df03216f16ddcde93753c3bbdca4bd3e2223d5e5c99ee8b0598.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93a8b83871462df03216f16ddcde93753c3bbdca4bd3e2223d5e5c99ee8b0598.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\magnify.exemagnify.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5316
-
-