2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rserver30\WinLpcDl.dll
Size 313KB
Sample260909-pg3mqswway
SHA256 2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b
MD5 b166a1bd564ada9c0b1c9eadb04b147e
SHA1 8a8fff142c03317a792321c2aa2554822712b3e4
SHA512 dc1bef2dbe9a3814864e9d68396e0512156563b05d35986aad3b628c94aba5bfa3a0a47a96985e223ad7c10ae5cfcf4a8b99918cc04104dd5873e30a66febcd9
SSDEEP 6144:Mj8MtsrUo3TDmWBySmw7Q5Sq9YEsagdHK2gq:otsIo3TqItmhSqMHK9q
TLSH
T19C64AF207695C0B7F91601BD420BD3691BB6BD115B290DC3B7E12EAA5F323D16E3E30A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1404	2128	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rserver30\WinLpcDl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rserver30\WinLpcDl.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads