73f5e1a5820358114771c96eab9dbc083c08454dcbae01ea079312fcae2040d9

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Optimizacion GTA SA OptiJuegos/Optimizacion GTA SA/Archivos de Optimizacion/scripts/Optimiser.dll
Size 55KB
Sample261002-sefa7swscx
SHA256 73f5e1a5820358114771c96eab9dbc083c08454dcbae01ea079312fcae2040d9
MD5 d76bae02e0ebfc66aeba5f5f7add4276
SHA1 bc67f7ccc2937dc6a2b2244216eb60e59b6b46f5
SHA512 d5f91e33faa446d9bc1c8c286c52996e9dcec49a7a9ec243f83dbf1248020ff445286baeb86d61f12bf0115181a41f49ef3c3fc44a3f6b269eaf88648519d1ca
SSDEEP 1536:aVZkqpP/xG8tkfJuFcS2MgK1k5otiPIcG8GYDwkW:CaqpP/xGUcS2MR16LOk
TLSH
T1B5438D27BC90C435F45888F06C7C9A77FE7E9AB40961826B17C4D5788DF6260EE0A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	708	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 708	752	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Optimizacion GTA SA OptiJuegos\Optimizacion GTA SA\Archivos de Optimizacion\scripts\Optimiser.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Optimizacion GTA SA OptiJuegos\Optimizacion GTA SA\Archivos de Optimizacion\scripts\Optimiser.dll",#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 604
    3⤵
    - Program crash
    PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 708 -ip 708
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/708-0-0x0000000000450000-0x0000000000468000-memory.dmp

Download

memory/708-1-0x0000000000450000-0x0000000000468000-memory.dmp