Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/09/2026, 22:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll
- Size 65KB
- Sample260901-2xextsyeng
- SHA256 c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9
- MD5 f937cd5681abae9f405f31fff720a2ba
- SHA1 fd43fbed29aea390d4b9b6d24cad02e1bb0b1459
- SHA512 caa0729f1d5563d1a40f29ab6cea0c68bf2197e4b75c7470796cc50c743cf67ecc94caa886048ba8cf5605f6b282e15cd265526413dd5ffe080d3ce42841ce01
- SSDEEP 768:yWJowbyBZaRJMoQZBHn3BHqCBHscBHywBHqWBBKjBHv/BFnhBHGTBHZ1Bf3lBHag:pJDbuqyMCRiBVWDG
- TLSH T1CB631906C7D90467E9F2B73006BE9B780175FD084F218E1FB115816A3BB0BA4DF69B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language magnify.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe 5628 rundll32.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2508 magnify.exe 2508 magnify.exe 2508 magnify.exe 2508 magnify.exe 2508 magnify.exe 2508 magnify.exe 2508 magnify.exe 2508 magnify.exe 2508 magnify.exe 2508 magnify.exe 2508 magnify.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2836 wrote to memory of 5628 2836 rundll32.exe 88 PID 5628 wrote to memory of 2508 5628 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\magnify.exemagnify.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2508
-
-