62b220f6403c4a60f65856592a097e1a8a25512deb0a7a930006ed559cec7e65

Analysis

max time kernel
148s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pb/dll/wc001203.dll
Size 492KB
Sample260916-tkzgpsdk5v
SHA256 62b220f6403c4a60f65856592a097e1a8a25512deb0a7a930006ed559cec7e65
MD5 627aec7a23a36ac428dd252d3f9e7401
SHA1 f71ae9598cdcb95cc0dc8b76eb7d3c80e4469708
SHA512 4f8ecd88df9e06ccb769fea15d1662fc7b045b56d05db0613b3726b7896c5aa034b2b3768982e020895a0900e4f4151f04999647393c10958a4ec058ca41a9e3
SSDEEP 12288:DH43b+91eTvhi6HlVnWYuytPnnNpiKSGh5D9QNPJErHlwGL9C/T97gQDirxg0zZE:DH43b+91eTvhi6HlVnWYuytPnnviKSGS
TLSH
T13FB47CE1D45330B2EAED0B7825D63322AE35FD65676504EB46DC24A4B4C1AC16CA83FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3368	2472	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2472	4300	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pb\dll\wc001203.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pb\dll\wc001203.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 596
    3⤵
    - Program crash
    PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2472 -ip 2472
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads