6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:16

Target
jaffacakes118_6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2.dll
Size 25KB
Sample260925-wwl2vsty8m
SHA256 6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2
MD5 84c7f9a3e287f79dc07e44068b46dfa5
SHA1 5c674c3eef56219577b31be37f8a17b5928bbe87
SHA512 8d8a58a4a298980a824b4f8d27b41c8a36e7949d1964af2b0835afec4ccef081c1ccff785c985716a556a243166439c0e47bc262f693d4eda317c532cc01bda7
SSDEEP 384:6p80a4wl1tu3zJFVPhttXR6j03ozkkEt3oP1YsZm3xdvjXimreU65Fj3:S80a4xXpXR8zk3doP1YsudvjX9I93
TLSH
T19CC2FA832E951CF0DE2C513430E72F76C17D2BB50696A5C7AB13DCA59C6B1A2263E783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	rundll32.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SfcDisable = "4294967197"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
688	4836	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4836	4848	rundll32.exe	87
PID 4836 wrote to memory of 3600	4836	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2.dll,#1
  2⤵
  - Checks computer location settings
  - Modifies WinLogon
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\sfc.exe
    "C:\Windows\system32\sfc.exe" /REVERT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 1276
    3⤵
    - Program crash
    PID:688