Analysis
- user interaction
yes - max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/10/2026, 12:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Q1949114311.exe
Resource
win10v2004-20260911-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Q1949114311.exe
Resource
win11ltsc2024-20260911-en
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
RiMe.dll
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
RiMe.dll
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
odexl32.dll
Resource
win10v2004-20260911-en
2 signatures
150 seconds
General
- Target odexl32.dll
- Size 9KB
- Sample261009-pvsppaex6j
- SHA256 74d8dfb194538138159fa1b00f2df8b4c4fdc30f1cd54598053fdc3a2db40473
- MD5 089c7b11c735aad9f9a9a14f4fe78729
- SHA1 a09615267e274a9650ef600d68b073a6632b68e5
- SHA512 f65c177d84cf26337de14fde5e1e134f3185559e4fbd79b9b0e2237712aa92cefa29a143886d7e398afafd322a49a68bfa94c7428173d873f6b4dbdfde0bf313
- SSDEEP 96:3ZKGVqxbUERHAi1e4owcbswog++2TpsmzoNwStpl/CtEWqqWwxWj7W:JKGVqjjo4PmsddXxSLl/7WqqWhj
- TLSH T17912B746B76449A6F7DE1BB534BEAB27223D7D340FB151D35992220D3868DC2ACB1322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6132 wrote to memory of 5808 6132 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\odexl32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\odexl32.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5808
-