630501913e1797d2dd91c3441bfac4e0b9e5340a0c3fab018ac3d98136a14006

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpefc8z6o3.exe
Size 173KB
Sample260518-17qlmsdv5x
SHA256 630501913e1797d2dd91c3441bfac4e0b9e5340a0c3fab018ac3d98136a14006
MD5 a8b2040f48ba52cab49117636185bdcb
SHA1 084fd006c562cd0a6114018208948f8bfcd0a465
SHA512 142d2d128494abf36f6d97590f6ec8881c7ddde559644b5281f8e65582550937192b2499c905285d2c4d0fc65b6e326cf781d917d688fa5e06ecfbdb7a8693df
SSDEEP 3072:T4lLpkXGED3iNuYDbRKAuyUXm6BkJ+d5qrLbdjZSCQbnN8oQsy0oeoS:4pkXGhn3EUODBH4DQ58o75oS
TLSH
T1470412A057B0E017D2F15AB11E7A26638FE3FA216015AF070760FC49BE563819F1E7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4680	tmpefc8z6o3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	4680	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpefc8z6o3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4680	tmpefc8z6o3.exe
4680	tmpefc8z6o3.exe
4680	tmpefc8z6o3.exe
4680	tmpefc8z6o3.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3804	4680	tmpefc8z6o3.exe	83

C:\Users\Admin\AppData\Local\Temp\tmpefc8z6o3.exe
"C:\Users\Admin\AppData\Local\Temp\tmpefc8z6o3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\tmpefc8z6o3.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpefc8z6o3.exe"
  2⤵
  PID:3804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 812
  2⤵
  - Program crash
  PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4680 -ip 4680
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb7B56.tmp\System.dll
Size 11KB
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89
SSDEEP 192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
TLSH
T1D0325C12135081F3E4918138C86B3A276B6A15029BF98E97DFD39546BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4680-7-0x00000000027E0000-0x00000000027E3000-memory.dmp

Download

memory/4680-9-0x00000000027E0000-0x00000000027E3000-memory.dmp

Download