d362aef674b098e643f93fe2731e7b244da615efbea029f4c423967609fb698a

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 05:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d362aef674b098e643f93fe2731e7b244da615efbea029f4c423967609fb698a.dll
Size 19KB
Sample260925-f79pas1bpg
SHA256 d362aef674b098e643f93fe2731e7b244da615efbea029f4c423967609fb698a
MD5 7eba0ace223ac195a3eb8c09614b3963
SHA1 a35037752df1b646f54ea5169ff3d908db282665
SHA512 d25056591ff19bd992540e66c6319587b0d362fa72013a74cc575010c13328a499d2ec1ddf771b6dc297808b898b36aed4ad384e6ec018bee61c9ffb353bcf6c
SSDEEP 384:lOOl9XPoB/Vf+7fhUHeM/c6a2OUUChn23+tzhjsmo/r:VXPoB/grp29n23+zjSr
TLSH
T17A920A870E382403FE858FB490C9E2275DB4F7D5BFD95083142AD1993E867E13BA961E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 2564	4168	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d362aef674b098e643f93fe2731e7b244da615efbea029f4c423967609fb698a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d362aef674b098e643f93fe2731e7b244da615efbea029f4c423967609fb698a.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2564-0-0x0000000000010000-0x0000000000011000-memory.dmp

Download