47699a5c895751cc7875d9330b428cdef9dd3284c2f5cca891de1eea6b9e700c

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
47699a5c895751cc7875d9330b428cdef9dd3284c2f5cca891de1eea6b9e700c.dll
Size 11KB
Sample260830-2swd1stwe1
SHA256 47699a5c895751cc7875d9330b428cdef9dd3284c2f5cca891de1eea6b9e700c
MD5 44a46b17c5b99b636b9311c8e8768298
SHA1 ab433efc029b47f0e92e7a5f9184fd0cad36e687
SHA512 85667b5503670ce5d9465e36690cd698c7899a0ad2d68633a58db76b3665756da68c6afb07268434b9787bb3ef1dcb5f4751697486d160469c0226b5d2c1e8ad
SSDEEP 192:u1qG+XKzc6UXKljNREBk4sfWYw18MQQfehX:w3ljqk4kFs8mfe
TLSH
T18D321846FF4816F6EA6A02302836577BC37CBD205EA2AD02B7D3561E0C39B85FD39165
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4184	3364	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3364	rundll32.exe
3364	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 3364	784	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47699a5c895751cc7875d9330b428cdef9dd3284c2f5cca891de1eea6b9e700c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47699a5c895751cc7875d9330b428cdef9dd3284c2f5cca891de1eea6b9e700c.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 500
    3⤵
    - Program crash
    PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3364 -ip 3364
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads