a511c8f646cafdc159698af8527def5d2dbd9dec1e13863b703cfd3b1757b8e5

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 07:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a511c8f646cafdc159698af8527def5d2dbd9dec1e13863b703cfd3b1757b8e5.dll
Size 1016KB
Sample260907-h28k6ayzhy
SHA256 a511c8f646cafdc159698af8527def5d2dbd9dec1e13863b703cfd3b1757b8e5
MD5 6d5f7e3aeffaba72ac31ac58414aa94a
SHA1 b1e8356116f7aaffa159d227ecbf426fe2558cae
SHA512 1c01a55c446ca6da5b9aab13941ab72f1b9f87322f8b390ada5d1c35f197028ede90edc01ccee38d2001dcd1374dac6420d84466b6c4ae29590c4acab0965caa
SSDEEP 24576:FiiOdUh+7klvwyJ/GA/8psdUjSbfzlTyJfx4QX4:FbOKhCklHt/8SbLMZo
TLSH
T1B3259E02B681C0B5C61D157416767F7B8E7D8B874B30CBC79768EEB83D33291A63624A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4168	4840	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a511c8f646cafdc159698af8527def5d2dbd9dec1e13863b703cfd3b1757b8e5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a511c8f646cafdc159698af8527def5d2dbd9dec1e13863b703cfd3b1757b8e5.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads