209bffd110cba0dfa1e0c25bae1b519a46f73b28ef04780b304b33bd0b08bb9e

Analysis

max time kernel
298s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
190014.exe
Size 12KB
Sample260427-psa2vset7k
SHA256 209bffd110cba0dfa1e0c25bae1b519a46f73b28ef04780b304b33bd0b08bb9e
MD5 74d41c1d4a30977b00e35575bbb2794f
SHA1 8afd460db01eb9367cba5ea6861314afece5abaa
SHA512 83a0b43d4a99f34a8b4dd74eab9708af8b91e408736eb1132de6537a0a1d239cfa6783c8da0df54deb1ac70031efeb496e91f8962db35dc9095f73630e162209
SSDEEP 192:zKJDFSeN0fs20x5JENqL/Gc7ze1k7INUOUNQjOhMaG/0:WJ10fP0SqrG6i1HNUOUiL
TLSH
T1A942E71173C8463AF0BF0F75ADB3922146B0F2564C67D72E68CA151B1EB6B40CE63B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4324	4216	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	190014.exe

C:\Users\Admin\AppData\Local\Temp\190014.exe
"C:\Users\Admin\AppData\Local\Temp\190014.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 804
  2⤵
  - Program crash
  PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4216 -ip 4216
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4216-0-0x0000000000590000-0x000000000059A000-memory.dmp

Download

memory/4216-1-0x0000000004F30000-0x00000000051B1000-memory.dmp