b19961de6ca07e08704d6372718542f70dbbb203e59bf9bbe3a58f6e069a625c

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/Aero.dll
Size 6KB
Sample261001-v2mpxaself
SHA256 b19961de6ca07e08704d6372718542f70dbbb203e59bf9bbe3a58f6e069a625c
MD5 869c5949a10b32d3a31966cc5291301b
SHA1 329080c974d593ecdefd02afa38dd663a10331c4
SHA512 3b9dde16e9ca803b1048243dbf29c717ac0472dffa764542c234318a960828834aa650b1dfb8bba66c4e7a9ce3aaf453829afc57dfb33dc8c311d203150d4fca
SSDEEP 96:AdxrhBuDBzndge+Kwv7KzxsJBuEGQKq+5okMU+S0767ZJG:IGB+Bh78xsPLGQKqEokSS0e7ZJ
TLSH
T19EC12A4577F8113EE0AAC73295AB062B7178BC40C7FB5AED0C0E145B38312908D89B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral4/memory/4292-0-0x0000000074970000-0x0000000074979000-memory.dmp	acprotect
behavioral4/memory/4292-2-0x0000000074970000-0x0000000074979000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/4292-0-0x0000000074970000-0x0000000074979000-memory.dmp	upx
behavioral4/memory/4292-2-0x0000000074970000-0x0000000074979000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3936	4292	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4292	2904	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Aero.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Aero.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 508
    3⤵
    - Program crash
    PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4292 -ip 4292
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4292-0-0x0000000074970000-0x0000000074979000-memory.dmp

Download

memory/4292-2-0x0000000074970000-0x0000000074979000-memory.dmp