8bca040ac638f79cf0ea7ac39a26a8736339665a9e6fb7d5ff94bbc2e20968fa

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__ae30b89fc19cd850b2a0f4701aaf4a71.dll
Size 75KB
Sample260919-yg4dpsware
SHA256 8bca040ac638f79cf0ea7ac39a26a8736339665a9e6fb7d5ff94bbc2e20968fa
MD5 ae30b89fc19cd850b2a0f4701aaf4a71
SHA1 ea3a3b05cc59f8338e247faab84481086f25111f
SHA512 fcfee4715736d12a356b5d41fbd420c0d20b3dd43fc61b92257dbfd1e98551ce8f62e2c44528c011811855cc183c347751a51847f4a8c6f27fae5bea2166de3c
SSDEEP 1536:GUEvd743gS4UDEeHKK4b0rn9leTJJhabHLWB2vDhBEQtaTkQf:EdcQZUDpKfw9leFJhcLRreTkQf
TLSH
T1DE73BF52FB60C4B3D2C7A6384984CB139A1ABD1049F0997B7AD20DDB2D77081CA7772B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3236	4308	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__ae30b89fc19cd850b2a0f4701aaf4a71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__ae30b89fc19cd850b2a0f4701aaf4a71.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3236-0-0x00000000004B0000-0x00000000004BA000-memory.dmp

Download