Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 06:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
687efed54e1bfd9409cc5ff6cd033315b47b4dd91888e8d10e56cf5b10318846.dll
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
687efed54e1bfd9409cc5ff6cd033315b47b4dd91888e8d10e56cf5b10318846.dll
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 687efed54e1bfd9409cc5ff6cd033315b47b4dd91888e8d10e56cf5b10318846.dll
- Size 1.2MB
- Sample261011-hp11jsdf22
- SHA256 687efed54e1bfd9409cc5ff6cd033315b47b4dd91888e8d10e56cf5b10318846
- MD5 ffc44483b66187a3973d9e18a1e21635
- SHA1 00ea5ef6bb1175d9096a9b96f2bcaf84b126a230
- SHA512 43763342f49d2f516731eea991597d9654ea6896d5be903d7a0c7252dc88cc4a585daa270b18941e12bdf8e858384a01431d95f05ac320da61ef2bdd99ca9d90
- SSDEEP 24576:rvteY/NPpBL60maViyUZeIImaoCaOqYh97LHKnh0anIlKA:R3iZIml16vWh
- TLSH T1C745AF03ED81C0F1C5083536257667766EBD8AC90F24CFA3E3ACDDBA6D32951963760A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4292 rundll32.exe 4292 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2352 wrote to memory of 4292 2352 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\687efed54e1bfd9409cc5ff6cd033315b47b4dd91888e8d10e56cf5b10318846.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\687efed54e1bfd9409cc5ff6cd033315b47b4dd91888e8d10e56cf5b10318846.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4292
-