1eb27cc31b95c1d0262ecbff542c0627f83e43bb08354d6c07f8b766a8e88f70

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1eb27cc31b95c1d0262ecbff542c0627f83e43bb08354d6c07f8b766a8e88f70.exe
Size 813KB
Sample260602-g4algags7k
SHA256 1eb27cc31b95c1d0262ecbff542c0627f83e43bb08354d6c07f8b766a8e88f70
MD5 b0bc56ea97be845090bc755335e280ce
SHA1 037b727bdade36c5951425f065e3f146c9bb9e07
SHA512 54f6a99401bad5899636cb6d3eeb3ed183518b0f3f510aa8d35f177efae9c05f9b37b1ea3166d4874a024d2adc75dc0315f8539b081accce317b435d5bfaf9ca
SSDEEP 12288:7LCdICnX25awdAKgvSV2xNj/3jb9mg/jxIWRV/TucqlcjqoeZTZ1LHGm:aNnXgawdOSV27zbsAjxxucqlcLeZ15m
TLSH
T13405BF2139E2C076D1733170485DC35866BAF4314A3A4AD7B7CC77AD2F246C19B25BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4764	1544	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1eb27cc31b95c1d0262ecbff542c0627f83e43bb08354d6c07f8b766a8e88f70.exe

C:\Users\Admin\AppData\Local\Temp\1eb27cc31b95c1d0262ecbff542c0627f83e43bb08354d6c07f8b766a8e88f70.exe
"C:\Users\Admin\AppData\Local\Temp\1eb27cc31b95c1d0262ecbff542c0627f83e43bb08354d6c07f8b766a8e88f70.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 536
  2⤵
  - Program crash
  PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1544 -ip 1544
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x0000000000930000-0x00000000009FC000-memory.dmp

Download

memory/1544-1-0x0000000000930000-0x00000000009FC000-memory.dmp