377fdff7fd24bf9257447480a8061e0380902f795ac5f8aac3738663b6503a3d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/02/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
capa-testfiles-master/0596c4ea5aa8def47f22c85d75aaca95.exe
Size 184KB
Sample260218-p7apmses6f
SHA256 377fdff7fd24bf9257447480a8061e0380902f795ac5f8aac3738663b6503a3d
MD5 0596c4ea5aa8def47f22c85d75aaca95
SHA1 f63ad8e1c86666a0d3a51f039e44f7cb17232933
SHA512 74c9f9f2c7c3b0cc9ccd1f01cf2ff03a5fbdc351df9e046be08914d134059b71badc865c7cfc941234e32f0593fc0646acfb336b6f6233e58faa7adc5bbe7ab0
SSDEEP 3072:R7TnqkLqEFdTpzNDB8O7TnqkLqEFdTpzNDB84:Rr9LqEFhpz38wr9LqEFhpz384
TLSH
T1F5048D25B6E581B2F1B6067E94B77B066BFEF8282476C56F87518A891C788C3C13D307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5176	4920	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0596c4ea5aa8def47f22c85d75aaca95.exe

C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\0596c4ea5aa8def47f22c85d75aaca95.exe
"C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\0596c4ea5aa8def47f22c85d75aaca95.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 492
  2⤵
  - Program crash
  PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4920 -ip 4920
1⤵
PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4920-0-0x00000000005B0000-0x00000000005C8000-memory.dmp

Download

memory/4920-1-0x0000000001070000-0x0000000001087000-memory.dmp