bd6fa6fd4824a19dd5c36c559bc929cfc6375c04c4012775c9f7318ebeebdc61

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd6fa6fd4824a19dd5c36c559bc929cfc6375c04c4012775c9f7318ebeebdc61.dll
Size 864KB
Sample261113-vjaydsdy5w
SHA256 bd6fa6fd4824a19dd5c36c559bc929cfc6375c04c4012775c9f7318ebeebdc61
MD5 71ea6eee931072415f94d3fdaf794f72
SHA1 5647c72b1312576b1a96200d540ac6fc0eb1a481
SHA512 41f8b43d69ff6b560fd690948b7d6c7ddb473297b03d2bab1445455c44542be4c7514a5b82c8840691de42764062157300089c40ff9c3c022d3338f3c31fed62
SSDEEP 12288:WI2BK3O2QEYkgKWIRaRiZpmwNg3111dh5gMw:WrBKerELgKQRspDQfnrgMw
TLSH
T152158F02E442C0B1D28C157665B67F3BDBB86E421E24CED7E7E4DE766C33060A63B51A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
264	6100	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6100	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 6100	2480	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6fa6fd4824a19dd5c36c559bc929cfc6375c04c4012775c9f7318ebeebdc61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6fa6fd4824a19dd5c36c559bc929cfc6375c04c4012775c9f7318ebeebdc61.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 480
    3⤵
    - Program crash
    PID:264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6100 -ip 6100
1⤵
PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads