00282050ddf4283e096717343ef24a36c8cc28621f5e460c7a0823f115d14e28

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_decimal.dll
Size 226KB
Sample260810-gpmbqasdld
SHA256 00282050ddf4283e096717343ef24a36c8cc28621f5e460c7a0823f115d14e28
MD5 e8c69fca50d73943c6da3ebbbae11292
SHA1 f19606a6b4a827cba250755111a7c184db94b555
SHA512 559720392497cad0e5fb6900b5a29c239bf447630904f840e2deeff3cf6745e2ef01cfb45687bb76c84dd86a9f32e606f2d5da3b04d32b046c8a292489a16561
SSDEEP 6144:n6xL+me+7lWyhrAPaoN9q2aZ3grW1gUSlfH3sjb:n6xLz7ljhkPaZhGH3s
TLSH
T14C344A12B64389B2F2E624B086FE44B6457C9830C3DB46D7E6F41CA09BE52E3717E785
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3360	1600	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 1600	4480	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_decimal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_decimal.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 596
    3⤵
    - Program crash
    PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1600 -ip 1600
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads