2b301d1b8ac8646866fefa5f8a04b8baeff26f76949ff0d7336b86c9d04c25b1

Resubmissions

22/10/2026, 16:03

261022-ththnsfz4k3

22/10/2026, 16:02

261022-tgxtpsdw2t3

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PhyziosStudioPro_Modded/PHYZIOSSystemManaged.dll
Size 2.8MB
Sample261022-ththnsfz4k
SHA256 2b301d1b8ac8646866fefa5f8a04b8baeff26f76949ff0d7336b86c9d04c25b1
MD5 604f7f5857b58c9234fdd1ccb18ed507
SHA1 28b90bd77bca4e6e80d1721e9181eae273397750
SHA512 fcf3dc6202b4495dd07a16a444b17e71b085a45cd6e9be317e8b02e24705347bc38b9146b2cb3bbef7919257763245104e6895b9919cb73eac9a0953c439d817
SSDEEP 49152:AY2PvleqOqTTGXBjqWvNbBCE3WbafwO8/u5mndR9oYru2yO8rcKuj0Il5fz0kHI0:r234uTTGZvnCEmbaf6/u5mn
TLSH
T19FD54A14A5F48EEBD88B6773F6DB126C502268D1A3111BE3512F872D49E07C8B5B3AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2732	5080	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PhyziosStudioPro_Modded\PHYZIOSSystemManaged.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PhyziosStudioPro_Modded\PHYZIOSSystemManaged.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x0000000002B60000-0x0000000002B96000-memory.dmp

Download

memory/2732-2-0x00000000010E0000-0x00000000010FD000-memory.dmp