7ff4654bc2158bb7b0133c03c18a93493ad23f7a7767a523c3a83e37e27d4268

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 15:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ff4654bc2158bb7b0133c03c18a93493ad23f7a7767a523c3a83e37e27d4268.dll
Size 1.2MB
Sample260924-szr6hawbpe
SHA256 7ff4654bc2158bb7b0133c03c18a93493ad23f7a7767a523c3a83e37e27d4268
MD5 aa65b506fbeab44dc42991e1eb1269bb
SHA1 1239668ed9d776eabc67438848e5a979eb7816c1
SHA512 c126e6588031e53a6b3f0fc6e46a109e5021170a2cdbb8e0bdf85cfee7384594a736923b572e4f390e9e2bd50157edd38af40f46017e547417fd3be3a2a53ed6
SSDEEP 24576:6g14mpGIOlg9J8HjukE42xiQQqjc44Hgmtj6lpyNrV:31xpGIO5STQcgl+lEV
TLSH
T1AE457D6327CBB3EBC0CA187C9462DE57505CE7B7CF00C987F95C992A5A53AC1391AE24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 1408	5792	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff4654bc2158bb7b0133c03c18a93493ad23f7a7767a523c3a83e37e27d4268.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff4654bc2158bb7b0133c03c18a93493ad23f7a7767a523c3a83e37e27d4268.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-0-0x0000000075170000-0x000000007529C000-memory.dmp

Download