333b199b0ee923057d31cde176c852eccc16704ca84ed492fbd4c110202e78c4

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
X-Scan-v3.3/dat/report.dll
Size 96KB
Sample260415-e55f5ah171
SHA256 333b199b0ee923057d31cde176c852eccc16704ca84ed492fbd4c110202e78c4
MD5 f0ef84caf10b64afc7c9af4049a16e54
SHA1 4582a7c1d499bb96dad8e9b227e9d5de9becdfc2
SHA512 0cc0fa6689a2a04f777e95059f9274ae50617bf3049b806f85b760bb930f33f28b83100401b06cfc040bd1ca5f73104e9df8bd108a33a4b87f1dc6770aa3da8c
SSDEEP 1536:gHd2q41FyysyctCQSPTBBkIs5d9J6hxoQ7JwoE:sIWyctCQmaduxo
TLSH
T16DA3AF0668C1C1B6F555C47750A29B37DABA321103E6D8D3DF68DDE28F606A0972E38F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1008	2452	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2452	4628	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\report.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\report.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 448
    3⤵
    - Program crash
    PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2452 -ip 2452
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2452-0-0x0000000001490000-0x000000000154B000-memory.dmp

Download