Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/09/2026, 22:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll
- Size 65KB
- Sample260901-2xextsyeng
- SHA256 c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9
- MD5 f937cd5681abae9f405f31fff720a2ba
- SHA1 fd43fbed29aea390d4b9b6d24cad02e1bb0b1459
- SHA512 caa0729f1d5563d1a40f29ab6cea0c68bf2197e4b75c7470796cc50c743cf67ecc94caa886048ba8cf5605f6b282e15cd265526413dd5ffe080d3ce42841ce01
- SSDEEP 768:yWJowbyBZaRJMoQZBHn3BHqCBHscBHywBHqWBBKjBHv/BFnhBHGTBHZ1Bf3lBHag:pJDbuqyMCRiBVWDG
- TLSH T1CB631906C7D90467E9F2B73006BE9B780175FD084F218E1FB115816A3BB0BA4DF69B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language magnify.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4900 magnify.exe 4900 magnify.exe 4900 magnify.exe 4900 magnify.exe 4900 magnify.exe 4900 magnify.exe 4900 magnify.exe 4900 magnify.exe 4900 magnify.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 896 wrote to memory of 4216 896 rundll32.exe 84 PID 4216 wrote to memory of 4900 4216 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\magnify.exemagnify.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4900
-
-