fb7f7ea6bb56171e08a7baa567a08f9fd615e31173806f5c7e9dd7ae2423fc56

Analysis

max time kernel
149s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Adobe Photoshop CC/icucnv40.dll
Size 715KB
Sample260604-bykllahx2p
SHA256 fb7f7ea6bb56171e08a7baa567a08f9fd615e31173806f5c7e9dd7ae2423fc56
MD5 a0126d30d73e08419648bd33a174c08c
SHA1 b74303467fc94ab7a766ac52f1e8d9f78cfb1ead
SHA512 5319e6169e8bfb7a3fadb1bae4ca32440f3d1545518f53a9035d2bd606d17541db024d43d09cfe3e3dc78bd670b0886a4cedcfd9d4773b3c106077180b903837
SSDEEP 12288:/6TIlFm5upCfrUH4YtgQwYnykkkkkkydlwb94/:/6TEmjTUH4rQLykkkkkkydlwb94/
TLSH
T17BF44B13FA43A022C29A46B0A5BB57B0B77A5C2BCE134CDA4F5C1D2078A12D5F1DD7DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4852	448	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 448	1732	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Adobe Photoshop CC\icucnv40.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Adobe Photoshop CC\icucnv40.dll",#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 616
    3⤵
    - Program crash
    PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 448 -ip 448
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads