c85e2f71b57d9770fdb0c35226eda672fae04d686ef4275896b0d6117e249eed

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Size 111KB
Sample261014-clrptaev2x
SHA256 c85e2f71b57d9770fdb0c35226eda672fae04d686ef4275896b0d6117e249eed
MD5 3eb3d321ae083583a798dc398dca10ff
SHA1 288c45375f691e95897f968e99c0248b9a2acad9
SHA512 ae39992c0b50b9ca1e8a6fd7f6ac3645057695757929174b87671021876f58db253a9c2dcb56b78ece9a3ee7ffb5a0d3588afa99fdb4ef00a6b42d19ad1904e3
SSDEEP 3072:h51cgW2Otk+3cDl0o1bZwYkBfhq3vaofsAR6fdwt8jdWMunmAqet/Bu:urk+Mx9e3f
TLSH
T135B307117BFA4266F5F3ABB07DF94233593ABDA0AD34C6AD1391160E1D34A21C964B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2364	3816	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-0-0x0000000001180000-0x000000000118A000-memory.dmp

Download