aba5031c161b65c52690f201f93d390e7b6bff6373384d0880a6007a315e5fb9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libReportParam2.dll
Size 855KB
Sample260527-tk11jadw6x
SHA256 aba5031c161b65c52690f201f93d390e7b6bff6373384d0880a6007a315e5fb9
MD5 5a7ce62d585ede65fbf320dca66f971d
SHA1 fae4519309283e33b76a0a766a8624dad53406c3
SHA512 d7e87179e5bf3e1c5f1314b65c453911c1ae185b7aad87ed73757b06f0fad38fa22e2fa217d058d9617faa2f938212d9cf4d520029a5f45a314ed6a27df0c273
SSDEEP 12288:yOq97/78eFYato0rcLHE6UdQyUnAyTbD52Qfl7U5oCDI75RyYauT6iYsyTG3n6:y38uYat3czE3uX/5jfl7C9AzauOi/
TLSH
T15C15BF21B543C032D5AA41B05D3CBFAAA47DAD1A177585EBB3D43E2DAD300D32B31B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4356	4896	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4896	4436	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libReportParam2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libReportParam2.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 612
    3⤵
    - Program crash
    PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4896 -ip 4896
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads