12c5a21bfe895af437a900b6f3463bb4c1e767b63cc6a619e478ed5654ada948

Analysis

max time kernel
149s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
建筑学院图档管理软件（学生）/建筑学院图档管理软件(13-09-13版本).exe
Size 1.7MB
Sample260511-j1wqmsgx7l
SHA256 12c5a21bfe895af437a900b6f3463bb4c1e767b63cc6a619e478ed5654ada948
MD5 0fa8b4bd114eac0bca4e2d0057673be4
SHA1 f06b0c7c32474cf72c0c707078779eaf368d11e6
SHA512 69410f48236f9fb9e53362c5c7e37b4fc3149c4e20dd6d620ef36ee1f8beb53401542e940d429ee45f83cd4b8ce73a0fd9a7b079df876322f08260b74a1cdb63
SSDEEP 24576:oNf8dNrdzEPbvHDDLCzZugJZGgmLs3nrCrwld7SYYK2dw1ymKwjDDFtpa/r:oSm7CzZugJZGtLs3nrCrOdxP2dw1ymc
TLSH
T18C857E32B2A14837C163163DAD3B5798AD29FE102AB89D4F3BF51C8C5F797813829197
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3496	4356	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	建筑学院图档管理软件(13-09-13版本).exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4356	建筑学院图档管理软件(13-09-13版本).exe
4356	建筑学院图档管理软件(13-09-13版本).exe
4356	建筑学院图档管理软件(13-09-13版本).exe

C:\Users\Admin\AppData\Local\Temp\建筑学院图档管理软件（学生）\建筑学院图档管理软件(13-09-13版本).exe
"C:\Users\Admin\AppData\Local\Temp\建筑学院图档管理软件（学生）\建筑学院图档管理软件(13-09-13版本).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 904
  2⤵
  - Program crash
  PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4356 -ip 4356
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4356-0-0x000000000056E000-0x000000000056F000-memory.dmp

Download

memory/4356-1-0x0000000000400000-0x00000000005C3000-memory.dmp

Download

memory/4356-3-0x00000000023C0000-0x000000000241F000-memory.dmp

Download

memory/4356-2-0x0000000000400000-0x00000000005C3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads