751d3b248db6bc83927e6e30c18180a547e1f3a04ab55e06776eb377a9563542

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/AnimGif.dll
Size 12KB
Sample261110-wlk2tact7x
SHA256 751d3b248db6bc83927e6e30c18180a547e1f3a04ab55e06776eb377a9563542
MD5 6ebf230433155f750832677a49a30ee3
SHA1 3115d72099f1cb0dc5eea01e1b19741194c66967
SHA512 b938514e17b1cfb7e0a7334c835788dd6fc70fb74cfbb0a2c678f6686d5674440fae7e9402d38ed614e3d9b0824940d73ac3fea83808f9a4a9761f39149f6b3f
SSDEEP 192:0nJ/LON9CxheJr/7H2B6lHv0hXbh3IQ5w:Y/e80JTvH2Xbq2w
TLSH
T16242F902AA01C1F3E453753A15AE3972EAEAE382A5705F8BC727EC6918201527D3D34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5256	6072	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 6072	3080	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnimGif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnimGif.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 616
    3⤵
    - Program crash
    PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6072 -ip 6072
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads