2a1b4c3dd8eafa6113a2c379299356fe1d9a8395584134145fb51560b2cab576

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DXStudio/Awesomium.dll
Size 8.4MB
Sample260810-dr8e7azfra
SHA256 2a1b4c3dd8eafa6113a2c379299356fe1d9a8395584134145fb51560b2cab576
MD5 556185bb963af3c3bbe4128b8597eca4
SHA1 05d9a9e53d9f49635a69dca186b4d0f441365168
SHA512 ad6b9f6a831dc895bf8a96748ac33d83d103eafd078ec18056c153fdcd8ead40c5788b0bf1d113e0c605b5c18d72a350a0efa394fabcfb35e0a3a8b1075e6ada
SSDEEP 196608:3S5w5g2DL0wy7QHyg5z0qvj7POJRQ7i55AMF5fE:3S57My+yE0qvjzOJRgi59
TLSH
T1DE967C23E9418135E6DB21FBD7FE7B7DA9688A10131951CB66C938846B706F33A39343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5652	3300	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 3300	3760	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DXStudio\Awesomium.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DXStudio\Awesomium.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 680
    3⤵
    - Program crash
    PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3300 -ip 3300
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads