56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
09/05/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8.exe
Size 469KB
Sample260509-tr7rnady2l
SHA256 56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8
MD5 b39d7704b367085b26f86743b28f0001
SHA1 9e5475a7797cc8775aa0847cc1dcfc6b2702fc43
SHA512 b7b57759ef32da570a6567318bd8436ff688611d10efe756b5b6150079336451da7982f2e9e5c321cb5634eb2fdf3d69d1e1955f8738b3d13a0b9238d7692ee7
SSDEEP 12288:Ymnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSCn9:IiLJbpI7I2WhQqZ7C9
TLSH
T1EFA4AE02BAD2C072D57161344D2AE735DABDBC212835997BB3E61D5BFD30180A73A7B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	1648	WerFault.exe	77

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8.exe

C:\Users\Admin\AppData\Local\Temp\56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8.exe
"C:\Users\Admin\AppData\Local\Temp\56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 552
  2⤵
  - Program crash
  PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1648 -ip 1648
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-0-0x0000000000B30000-0x0000000000BAA000-memory.dmp

Download