93231cc4f5debb1355267a8be3dde510e3c4b608494b4485a5a56f58ae3be4f6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader/Lib/msvcr120.dll
Size 944KB
Sample260502-ptpxeafy21
SHA256 93231cc4f5debb1355267a8be3dde510e3c4b608494b4485a5a56f58ae3be4f6
MD5 5155495059a198e6b83d1e0ca6c36582
SHA1 b28d4917ba331a237cac8eaa8e83beb74d2619ec
SHA512 74a05be3b777c402b2c92335c061696dd5b2d9dabd4351f2ffd4edf262e2b365ce743368208c58a97ef4f10e7cc8f6280b2fd50d49d0286e36f9ca952d934d4f
SSDEEP 24576:0mFyjr0XnrmKnxvHeDJqN5br94sVs+Vbh:hXd4ebr9s+Vbh
TLSH
T10725BE12B982C0B2C57602B1552DA6321ABFBD71443588B7BBD98F0E1DB45C0FB67B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	4412	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4412	5012	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Loader\Lib\msvcr120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Loader\Lib\msvcr120.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 600
    3⤵
    - Program crash
    PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4412 -ip 4412
1⤵
PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4412-0-0x0000000075275000-0x0000000075276000-memory.dmp

Download

memory/4412-1-0x0000000000F90000-0x000000000104F000-memory.dmp