161339aae4a2481da620ccd29e574f5582dd43e641e8b66701ab88acb5528ea3

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
161339aae4a2481da620ccd29e574f5582dd43e641e8b66701ab88acb5528ea3.dll
Size 136KB
Sample261017-c569lsvyay
SHA256 161339aae4a2481da620ccd29e574f5582dd43e641e8b66701ab88acb5528ea3
MD5 d4872b11da6968f5574c2f2d078ffbee
SHA1 dd0e79aa28f0cbfec7587da12d69f5361782b51b
SHA512 9ed270e1613d19b8a695d68f4a1fc3b9a414263465986103ae7183ed9aede13002e8e7bb489717380a2d86ca38b6e310e8e99b6755139d659997f09d8c22747f
SSDEEP 3072:n8RbmGympdL3Zn/vIUKD5MAZyNqIkO5qvUb2eGqWBjEUBbV6w4SyVUZng:n8Yn
TLSH
T1F1D3D6A4779CC950F1B39A3D38395BE5AF22FC101B3657498E86766D0C349A8EE2D703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 792	1912	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\161339aae4a2481da620ccd29e574f5582dd43e641e8b66701ab88acb5528ea3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\161339aae4a2481da620ccd29e574f5582dd43e641e8b66701ab88acb5528ea3.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads