Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/07/2026, 16:34
General
- Target b8d5103e65aa82c7d1fcb4066688d7e37a59455fc590262dbc4cfbf64f6f1a20.exe
- Size 3.4MB
- Sample260701-t3lcssat4m
- SHA256 b8d5103e65aa82c7d1fcb4066688d7e37a59455fc590262dbc4cfbf64f6f1a20
Malware Config
Signatures
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8d5103e65aa82c7d1fcb4066688d7e37a59455fc590262dbc4cfbf64f6f1a20.exe"C:\Users\Admin\AppData\Local\Temp\b8d5103e65aa82c7d1fcb4066688d7e37a59455fc590262dbc4cfbf64f6f1a20.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 8042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 7922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2100 -ip 21001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2100 -ip 21001⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2100-1-0x0000000002550000-0x00000000025AF000-memory.dmp
memory/2100-0-0x0000000000400000-0x00000000007C8000-memory.dmp
memory/2100-11-0x0000000003640000-0x0000000003740000-memory.dmp
memory/2100-10-0x0000000003640000-0x0000000003740000-memory.dmp
memory/2100-13-0x0000000003640000-0x0000000003910000-memory.dmp
memory/2100-12-0x0000000003640000-0x0000000003910000-memory.dmp
memory/2100-9-0x0000000003640000-0x0000000003740000-memory.dmp
memory/2100-8-0x0000000003640000-0x0000000003740000-memory.dmp
memory/2100-7-0x0000000002790000-0x0000000002791000-memory.dmp
memory/2100-6-0x0000000002730000-0x0000000002731000-memory.dmp
memory/2100-5-0x0000000002750000-0x0000000002751000-memory.dmp
memory/2100-4-0x0000000002710000-0x0000000002711000-memory.dmp
memory/2100-3-0x0000000002720000-0x0000000002721000-memory.dmp
memory/2100-2-0x0000000002760000-0x0000000002761000-memory.dmp
memory/2100-14-0x0000000003640000-0x0000000003910000-memory.dmp
memory/2100-16-0x0000000003640000-0x0000000003641000-memory.dmp
memory/2100-19-0x0000000003690000-0x0000000003691000-memory.dmp
memory/2100-18-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/2100-17-0x0000000003630000-0x0000000003632000-memory.dmp
memory/2100-15-0x0000000003650000-0x0000000003651000-memory.dmp
memory/2100-20-0x0000000000400000-0x00000000007C8000-memory.dmp
memory/2100-21-0x0000000002550000-0x00000000025AF000-memory.dmp
memory/2100-22-0x0000000003640000-0x0000000003910000-memory.dmp
memory/2100-23-0x0000000003640000-0x0000000003740000-memory.dmp
memory/2100-24-0x0000000003640000-0x0000000003740000-memory.dmp
memory/2100-26-0x0000000003640000-0x0000000003740000-memory.dmp
memory/2100-25-0x0000000003640000-0x0000000003740000-memory.dmp
memory/2100-27-0x0000000003640000-0x0000000003910000-memory.dmp
memory/2100-28-0x0000000003640000-0x0000000003910000-memory.dmp
memory/2100-35-0x0000000004000000-0x000000000404E000-memory.dmp
memory/2100-34-0x0000000004000000-0x000000000404E000-memory.dmp