6663ba6ccdf87b9f0300538f3bddea8b97368b6170e579a8168f4676dbc2327f

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6663ba6ccdf87b9f0300538f3bddea8b97368b6170e579a8168f4676dbc2327f.dll
Size 556KB
Sample260903-smbyrazdmd
SHA256 6663ba6ccdf87b9f0300538f3bddea8b97368b6170e579a8168f4676dbc2327f
MD5 d17f86bb5b4bbc11bfc9a9a94a2df477
SHA1 f06bc7bc07437050400d705dbbb2ccf9a37fd1d2
SHA512 07b0a97091012e84b15b8282ba479e8fd91cd01d8fe202fcd530a516e7b1aa79767e312d705fa42e2dabad557f3cc508af780378940d8976ef1923956eeac031
SSDEEP 6144:zzgnQGXAz2kp71OYrACA6jPg4MptAxl/UiolSMW2IflnU7W57K:vKQGXk2QBjPyperlHflnOEe
TLSH
T1D4C48D75AFA04023E7AD0138D976DB921B36BF01AB91EBD79632251D8D342F2ED71B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 6104	472	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6663ba6ccdf87b9f0300538f3bddea8b97368b6170e579a8168f4676dbc2327f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6663ba6ccdf87b9f0300538f3bddea8b97368b6170e579a8168f4676dbc2327f.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads