8957cca723307720687283fa50df6b06883a90bac350be8d599544320b405c65

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DirectX9/dsetup32.dll
Size 1.9MB
Sample260907-p8nb5avygx
SHA256 8957cca723307720687283fa50df6b06883a90bac350be8d599544320b405c65
MD5 54a2e8e8b8672ab0921017b704d0eec7
SHA1 e50a789a57c3cbff71237d8f3fed98a8f053396d
SHA512 b996da13757ed86e1bd46e08b931a4484c9657d730cd4ba200da79f1b5afe25a13a827437d703abc278e9a3792482fbf69ae876c08c974ad322fa6d490c45237
SSDEEP 12288:3nXmBDofbzEWv/GGGGGGGGGGGGGGGGzUUUUUUUUUUUUUUUUt222222222222222w:GWDUUUUUUUUUUUUUUUU
TLSH
T163959F7D9AC201D4FB1AAFB217313ED7393C914BB826DE2071B5528841B779CC36AB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DirectX.log	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 4060	2628	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DirectX9\dsetup32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DirectX9\dsetup32.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DirectX.log

Path C:\Windows\DirectX.log
Size 587B
SHA256 f4d0c03419d18c9a588dd7343dba726a070a0a342390325b5fdb2a77829bf483
MD5 cf69132ca062dfd8f40f15a49b467901
SHA1 2908691a9d730be2f0fff23278e7afa03568d1e3
SHA512 be2b5173f2c6acc28fb331de9bd0ea2b8366d04c33b46a2f249d89f8bb83126aed2651ba1ddaca60ab8b9be66457db2729d394b22e7e2d33c1bc9ed3051c8bd9
TLSH
T1D0F0F6742EFF24911A127113C9477152DFBE9B238A9CCCDE3334863CA226A4E4E36661
MD5 SHA1 SHA512 TLSH

Submit Download