544b2bf4ccdaeaf6ce8f3e0d4faa98281ad17f65fc2defaec915d16d320dbda6

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrap.dll
Size 482KB
Sample260929-2eet4swdkc
SHA256 544b2bf4ccdaeaf6ce8f3e0d4faa98281ad17f65fc2defaec915d16d320dbda6
MD5 90a1760397db7be8a7a82b82cfb72d2c
SHA1 774f0a6c25a61b0e3c2c80fc4bc5830d4c77db55
SHA512 29439377953068d75902c205f2db5f40b0bc9925e6761082dcd0da722ed1301df8d1dbe93f8f0e301322a4e6c680139f0c21e0974387d3c20a00c6ca947b9ec4
SSDEEP 12288:laK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0Pas:39DeuBc/IPu8WMAF0Pas
TLSH
T1FEB4BF53AA80C1B3D18A017516B6B77B2E39A7355364D8C3F3D81D785E207E27A3938E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4980	3324	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 3324	3292	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrap.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 636
    3⤵
    - Program crash
    PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3324 -ip 3324
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads