381ec497d7d40b83616b0e82e15c597d04433acc20e94ebe5611f954b2e5309b

Analysis

max time kernel
149s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dark desire train/[Kimochi] RJ01134914 v1.01/d3dcompiler_47.dll
Size 3.5MB
Sample260809-3fa3zsch95
SHA256 381ec497d7d40b83616b0e82e15c597d04433acc20e94ebe5611f954b2e5309b
MD5 d808acb53436ca8bf04f88d3b40200cb
SHA1 493344c681a2269bb8c202f020ae0583814d2816
SHA512 86dc1ce2ae6c7a36b2f7d4a18278cec99a9a8743df657b2546ef46f0e8007c94d55354fe765a9c17a2fd5b15f21693691d177407b141be23bcde24635093efb5
SSDEEP 49152:1VBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFE:17ZMxpjAeHhtivBDwh1c51
TLSH
T13F069E21FB018076D8CB01B365AD7BA6A46C9731473441C3E19CAE55ED707E32B3AF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	1744	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1744	2136	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\d3dcompiler_47.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\d3dcompiler_47.dll",#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 412
    3⤵
    - Program crash
    PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1744 -ip 1744
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads