ee363573142bfc48e918f74af184245a8de95b9067764ef016b66d6d9ff7efc7

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee363573142bfc48e918f74af184245a8de95b9067764ef016b66d6d9ff7efc7.exe
Size 1.6MB
Sample260503-wdf3wsez21
SHA256 ee363573142bfc48e918f74af184245a8de95b9067764ef016b66d6d9ff7efc7
MD5 37cd80926f47ab1abde2af4b9922a714
SHA1 293e8b2420ce7d209ddc11b174b83ef0ef0735d3
SHA512 fae6f1dd99ea2080b92676f2e6ec20f2dde856f5c144f1315e501c9260d4f70aa274a35923baf85aa6cfe5b1ec889e481a809019cea0367a42fcf28d43e767cd
SSDEEP 49152:YRRc/IirvwnrWyb/+ADBJTbgvhiWaOuBuNXqY7RC0W1fUG:CRWQrXgvhiWaOuBuNXqY7RC0WV9
TLSH
T17E756C12E3D6C437E1B31E7A4C6AC6D45C2ABE201EB4941E3EF87A4C5F39B416C68653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4404	2068	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee363573142bfc48e918f74af184245a8de95b9067764ef016b66d6d9ff7efc7.exe

C:\Users\Admin\AppData\Local\Temp\ee363573142bfc48e918f74af184245a8de95b9067764ef016b66d6d9ff7efc7.exe
"C:\Users\Admin\AppData\Local\Temp\ee363573142bfc48e918f74af184245a8de95b9067764ef016b66d6d9ff7efc7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 444
  2⤵
  - Program crash
  PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2068 -ip 2068
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-0-0x0000000000400000-0x00000000005A5000-memory.dmp

Download

memory/2068-1-0x0000000000C60000-0x0000000000D3F000-memory.dmp