827b87801ce6a30a38628ecf9f0dbdbda80537ca0ec3938ad163197af993d8d6

Analysis

max time kernel
149s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
W.exe
Size 2.0MB
Sample260422-tpqqcsbs4n
SHA256 827b87801ce6a30a38628ecf9f0dbdbda80537ca0ec3938ad163197af993d8d6
MD5 fe9e0838bfc396b05c9beff82ab995bb
SHA1 241e6c240cd02b6d059b02e39a513601c7f8b6a9
SHA512 c901cca9322abccac8d3e0d49db532b702add349afc262072d8b452e8ab1b6cdf402fb74a0348770930559b4dc1c65649a1cc4f0f028f164ead1d6440fc0fb5e
SSDEEP 49152:YbD8EA1a5k2K03KQs7FBcK0UWi1xHUJK4NxczJE2:Y7A1kSZ0Ur1uJWh
TLSH
T174A5BE551C08433247E44DDF8985ED6AC2C8DA85C54CE78386EB63B7E12EDECA4E11FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	1728	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	W.exe

C:\Users\Admin\AppData\Local\Temp\W.exe
"C:\Users\Admin\AppData\Local\Temp\W.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 812
  2⤵
  - Program crash
  PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1728 -ip 1728
1⤵
PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000000430000-0x0000000000438000-memory.dmp

Download

memory/1728-2-0x0000000004EA0000-0x00000000050A3000-memory.dmp

Download

memory/1728-4-0x0000000000940000-0x0000000000962000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads