4cd7008f781282da2f51cd0393c02a88f47de0d66db2252776cdc59478c50bff

Analysis

max time kernel
149s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
19/04/2026, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Plugins/FX/reasamplomatic.dll
Size 490KB
Sample260419-t2pc3ab16s
SHA256 4cd7008f781282da2f51cd0393c02a88f47de0d66db2252776cdc59478c50bff
MD5 e2a543f2761105647928d0fb4f922fe7
SHA1 3530085dfbe9b3c08377eae2e330e6905907f3a0
SHA512 4933b3d718112b54e22a991f1c96acc43a559e15224a3dafedfa66c86f80a349796d57010787fc0915ed1182186949efae73d10690e69977e5ca6a54c5baeb1a
SSDEEP 6144:gCB8TPGQVSuJNW1GnSmf97j8GP+pAfzk2uPwqCtmnRxGhsnhUkqKS:g08zGQfJY1GnSY97vb4CtsBg
TLSH
T1FEB4BF5270D3D1F6C05E0870629697335F79391A4631DABBBFE45E6C0E72642AB3A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4512	4948	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 4948	1172	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reasamplomatic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reasamplomatic.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 624
    3⤵
    - Program crash
    PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4948 -ip 4948
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4948-0-0x0000000001460000-0x00000000014A5000-memory.dmp

Download