0b6a1c6756aaa9bfd48fba5c5bf54e79cdf01f2657827d7b3ec367d2f45482d5

Analysis

max time kernel
298s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
185227.dll
Size 330KB
Sample260424-k92tpaez3p
SHA256 0b6a1c6756aaa9bfd48fba5c5bf54e79cdf01f2657827d7b3ec367d2f45482d5
MD5 c10102a81636d59c557fe373863e281e
SHA1 d75d785217630c79a161f79f9209a1a21d54c455
SHA512 d4041cb4429e19bd7899103c31bda0efa3f4ab0d70785f202d6b8f2493d60145ed490823f102221620486fe56bfd477bf24a5972f57d1b779353156da92531bb
SSDEEP 6144:Hez4PIEnBrvNbnsMQ368ePA4LHNuNgDKt6A/1jqJ76:+zeIkBjFmcP/uNOG/1jr
TLSH
T1BA74F721AD8582B0EDEF37B9194D307C419ED4A24B9001C7CB988BEAAC607E15F756DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4460	4132	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 4132	2396	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\185227.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\185227.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 644
    3⤵
    - Program crash
    PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4132 -ip 4132
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4132-0-0x0000000000A00000-0x0000000000A87000-memory.dmp

Download