60e76c94ae1f420445d1cfaa4268f84ae8fb8dba27beee3c3301be466e91d7ef

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
Sample260508-aramdafv7k
SHA256 60e76c94ae1f420445d1cfaa4268f84ae8fb8dba27beee3c3301be466e91d7ef
MD5 ac01e62e71960807130cb2fefd358ad5
SHA1 4887cfb5c2db2521e153571b39b77a9d05595248
SHA512 8a95874eab800da648f6bde9a0d3cd3f0fec2c033cd151c06aa43c39f0747c8d0f318c538ec46681537689eefb6636df1f9f03bc45a2e9faa66f204c664831da
SSDEEP 384:dWEhWMm57A0GftpBjm7kERHRN7LGl6UnV:FrGPiwkEBL6V
TLSH
T1F69229D6CABC9043EC976D7063ECD9837D3DA7D71920891904ABF4A92C833D5EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4420	1552	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1552	1972	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\api-ms-win-core-timezone-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\api-ms-win-core-timezone-l1-1-0.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 600
    3⤵
    - Program crash
    PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1552 -ip 1552
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads