f6b52e8a0cfce7e253a4ef10cb203689e1e9dee7a57ee6b3623e7fff3a150669

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpjfrt7d1w.exe
Size 549KB
Sample260601-v33grabw81
SHA256 f6b52e8a0cfce7e253a4ef10cb203689e1e9dee7a57ee6b3623e7fff3a150669
MD5 4279a741547c1107f74f81cada4bacb5
SHA1 a56af8d06b5d3f645aae23b5d541336c167c03b1
SHA512 58bea12bce6a7184585fc6b075c31cd3256d12881f9ffb2fc629139f6cd59425e3855c2a38b28f06cc683d892fd225dd4ee0b6aadbc056423c388f12b6130b69
SSDEEP 6144:foILbzMYhdAgfzJ4F9ZXjrXyT9T0MRNniKJ7GmQ2c/UoSqer5+nDFor:5PzMYhbJE3eZNqer5+nZo
TLSH
T13FC47C1536A1A0E2EEB74F3069209590DA3BBCE36B70459E35D43FDE5D336E08E15B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5916	4692	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpjfrt7d1w.exe

C:\Users\Admin\AppData\Local\Temp\tmpjfrt7d1w.exe
"C:\Users\Admin\AppData\Local\Temp\tmpjfrt7d1w.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1260
  2⤵
  - Program crash
  PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4692 -ip 4692
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4692-2-0x00000000044B0000-0x0000000004500000-memory.dmp

Download

memory/4692-1-0x0000000002A10000-0x0000000002B10000-memory.dmp

Download

memory/4692-3-0x0000000002A10000-0x0000000002B10000-memory.dmp

Download

memory/4692-5-0x00000000044B0000-0x0000000004500000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads