2a6bf612d52020e1479e9308a5ecd5e382f9f7b799e169a174a834c6e9bf4188

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/BCUnRAR.dll
Size 331KB
Sample260823-wp7d8atwey
SHA256 2a6bf612d52020e1479e9308a5ecd5e382f9f7b799e169a174a834c6e9bf4188
MD5 9a3f047220d30830e211cb0f02a04b08
SHA1 c335c723560d6fb416758c0e561e37826e174e71
SHA512 887b39ba298567a0a9bc0453c0c7e21bd2d481937dfc89c63388ddbcb9e27d1f522f8b7f127bc3ae0dee9eaf98a84d808f03a32cc94847f6368cc4f4edbd9c61
SSDEEP 6144:TR9op0t7ou7sLTUhCNc2U7gG9/gE1zQ5LmayLzlHtla3YNFFKdwevH9:V9oGt17mTUUy2Usg/7QIDz5tL6wevH9
TLSH
T18C74AF30B993C0B2E99E0970782D9FABAD3D6B601F7194CBE3D04CF65D202D16736969
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4520	4344	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4344	3796	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BCUnRAR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BCUnRAR.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 612
    3⤵
    - Program crash
    PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4344 -ip 4344
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads