a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 08:21

Target
a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe
Size 870KB
Sample260706-j9fqsacs91
SHA256 a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53
MD5 bfdafa5f489a6cb6fec41644d759abfd
SHA1 cb9bfb614d0a9a69d36cbb9139a2e8ffbdb80d62
SHA512 848dda30660641159f603d894d8d2bfd60a491b0071afd7f9566585bad098e8427184df686ae85483024c5d1dd40081f97f1ffd91f046f32e4cbc686748b68bd
SSDEEP 12288:huFK5RuFK57GF1cQlOYtp9NrHwt8L6o8u2DNYlg2317e5uiVWBHCKDlpyPQEb+CC:k3NrpUGhCC+Hb+CGmw
TLSH
T15715A26D5E6CABBDD748A0BC174C5228601797248A3C8BF1EDC62D1EA510D85BC933EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1176	1220	WerFault.exe	87
860	1076	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2588	schtasks.exe
2104	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 4284	1220	a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe	88
PID 4284 wrote to memory of 2588	4284	cmd.exe	90
PID 1076 wrote to memory of 4460	1076	a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe	96
PID 4460 wrote to memory of 2104	4460	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe
"C:\Users\Admin\AppData\Local\Temp\a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn \MadPoison /tr "C:\Users\Admin\AppData\Local\Temp\a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe" /st 00:00 /du 9999:59 /sc once /ri 30 /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn \MadPoison /tr "C:\Users\Admin\AppData\Local\Temp\a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe" /st 00:00 /du 9999:59 /sc once /ri 30 /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 372
  2⤵
  - Program crash
  PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1220 -ip 1220
1⤵
PID:4788

C:\Users\Admin\AppData\Local\Temp\a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe
C:\Users\Admin\AppData\Local\Temp\a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn \MadPoison /tr "C:\Users\Admin\AppData\Local\Temp\a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe" /st 00:00 /du 9999:59 /sc once /ri 30 /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn \MadPoison /tr "C:\Users\Admin\AppData\Local\Temp\a746fb8f904e2fd18c7d9d36b941ff52db5685d3f9b768099959c662c1f38c53.exe" /st 00:00 /du 9999:59 /sc once /ri 30 /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 380
  2⤵
  - Program crash
  PID:860