959c090aa0c41925dbeafbbd455cd766f8d3b8d62ad47b8f8a0116ad542efe79

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/LuaBridge.dll
Size 12KB
Sample261002-ml7fdagd34
SHA256 959c090aa0c41925dbeafbbd455cd766f8d3b8d62ad47b8f8a0116ad542efe79
MD5 8e11ed4d0b151add7e69bdd36bdfe349
SHA1 6cddd66e26a3a2d98b32f5db6f39e6a32f9b3807
SHA512 4eeac9ce126c87b068d412b72c8c6c73ba5160b39f9f302aa5c16014cbc9d5c4dbbfb0881c65736c85131266f18b5f5814bdff0de5e602b91b9972802b8c0fcc
SSDEEP 192:i7eFv+UTmEZbZIPlKt5tswGZQu1PQrnWVwxlhgzNpkfnT:iOvHTXZbStWu/lPQr7lOzNCT
TLSH
T1F742F801632104B1DF9501B1B077BF128AFA780172C3585A9F5E66893D63B96DF3B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	4820	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4820	4720	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaBridge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaBridge.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 616
    3⤵
    - Program crash
    PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4820 -ip 4820
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads