e3afb3453de08f67a0e8f5e20c9b300eb07fdb4685fc7c96ab768f0fabc3c4fa

Analysis

user interaction
yes
max time kernel
117s
max time network
122s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/08/2026, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
goodstuff.dll
Size 7.9MB
Sample260807-mrjlhack4y
SHA256 e3afb3453de08f67a0e8f5e20c9b300eb07fdb4685fc7c96ab768f0fabc3c4fa
MD5 6e3386317a39f9639fa32d195b01542f
SHA1 2d268ef106a6b3e5062adf1e91b808d46f27d241
SHA512 1fdcc7d4937428c19e8e573f1975f13cc2af360b37dd092d1dcbd9a2d893a0f1cb9d84c45adcfe76bf891ac66e9db93cbd2099c1282956c52c2f81e3c3113ff4
SSDEEP 196608:sQ/gCTpiVLWL5YgWpRhMVKoW0bGIXaG481H92HMcntSVO:jgFTDxWznx2HMcA
TLSH
T1EC86237262A901BED1E5C83E4E37FEB631F1032F5A83A475AC997DD43486470F60B896
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3648	3368	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\goodstuff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\goodstuff.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads