11a775562a7754f6c2d65ff17a2f3b5b51df82f28e39bd8282dd62bf21dc7b11

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11a775562a7754f6c2d65ff17a2f3b5b51df82f28e39bd8282dd62bf21dc7b11.dll
Size 3KB
Sample260825-s85sysbq51
SHA256 11a775562a7754f6c2d65ff17a2f3b5b51df82f28e39bd8282dd62bf21dc7b11
MD5 bb7ee75e321f57e39c981d05fd8ff557
SHA1 e6ca82d9740ffc80d608db804daceed4a93ec3fe
SHA512 314a9011f3a3515482101f0880ade5beadd66da889bb14a622cfd4c9550f5d416dd9115cad32e4fa5c707e2978d176749bf433a1807256c80d3dc465fd42042d
TLSH
T19351AC5BC3850A77C11E03B001EB80A3BAB6152083CF92110FA05D297D065627C7AF44
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 2552	4848	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11a775562a7754f6c2d65ff17a2f3b5b51df82f28e39bd8282dd62bf21dc7b11.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11a775562a7754f6c2d65ff17a2f3b5b51df82f28e39bd8282dd62bf21dc7b11.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads