ed10e243f8caaad1855458c1028a6b724fc643f5c986f45ead490f870ceb7942

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpmudtbw64.exe
Size 656KB
Sample260524-xwpnesht5w
SHA256 ed10e243f8caaad1855458c1028a6b724fc643f5c986f45ead490f870ceb7942
MD5 3a6e86ffb1e1276f1aab99e894f6ed96
SHA1 5feac1bb2cac12685d87f86424f9e3fe5f820a1e
SHA512 9c8f005148830ba07bea406954039b42eeadc8e55994e5d161bf6c7930adc2e6f14f6ffd9453d34e174e341d9651d1aa9345f139c91d9cf9211cc628872b334c
SSDEEP 12288:TLmv6J3O1b3pwFRNkdgUkFnl3jURuRe5n4GZ91Rd6qIXzsQxvXnfoMC0Yy:/mv66b32F7wQr7e5BnT6qkzs5Mzp
TLSH
T17EE47CC0699910FBD48A5F340031AB7B5DB42F204635DCEB854768D6AAACEFB423D727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4536	1380	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpmudtbw64.exe

C:\Users\Admin\AppData\Local\Temp\tmpmudtbw64.exe
"C:\Users\Admin\AppData\Local\Temp\tmpmudtbw64.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 1304
  2⤵
  - Program crash
  PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1380 -ip 1380
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-0-0x0000000000221000-0x0000000000222000-memory.dmp

Download

memory/1380-1-0x00000000001A0000-0x000000000024E000-memory.dmp

Download

memory/1380-5-0x00000000001A0000-0x000000000024E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads