219cbbd27f0f1fba1f79e5da3cc99e8a2ab09560adf5bff101393d7a0b3b6aae

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpuz3xhcyf.exe
Size 464KB
Sample260601-wp32ssdy7n
SHA256 219cbbd27f0f1fba1f79e5da3cc99e8a2ab09560adf5bff101393d7a0b3b6aae
MD5 057fc8cf4a9f4074b2b1cfff57f84361
SHA1 31dc22d6f2ed7abe3dcd14bfcfb6b16613eb29c0
SHA512 e24cb19b406ae16925b216001ce13afb06f130f6b709b00f4c16c3c238cd76e99fe2e4b12e1852678845b7efb4c257f6daf2639c6584f063d5788463f7893915
SSDEEP 6144:Ho4Qn2Rvp2bpnwXk4hJ/T2XHbD2lSUf1yG3MJ3JRJiJjJRJfJuJRJBJnJeJLo:HJQn2Rvp2Vn2t/TsHbDjQyGho
TLSH
T1ECA4CF7126E88CFBE09F1739D873AF774C25BA700C7166923AC0959F2E6D6D2461C392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	4424	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpuz3xhcyf.exe

C:\Users\Admin\AppData\Local\Temp\tmpuz3xhcyf.exe
"C:\Users\Admin\AppData\Local\Temp\tmpuz3xhcyf.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 836
  2⤵
  - Program crash
  PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4424 -ip 4424
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4424-0-0x0000000002C3F000-0x0000000002C40000-memory.dmp

Download

memory/4424-2-0x0000000000400000-0x0000000002C5B000-memory.dmp

Download

memory/4424-3-0x0000000000400000-0x0000000002C5B000-memory.dmp

Download

memory/4424-4-0x0000000000400000-0x0000000002C5B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads