79af5e57303ab6fb317711ba4e61d7f9ebd4ff81b82b518a41ce115553409a73

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
06/07/2026, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PhotoHunt-32.exe
Size 115KB
Sample260706-myeacsdz21
SHA256 79af5e57303ab6fb317711ba4e61d7f9ebd4ff81b82b518a41ce115553409a73
MD5 c1ced1caa891e99b56b4d236dc6fc1f1
SHA1 62f05a3f5a50b135a396a03de7731de6a4594462
SHA512 7ea5c2dafe77a5c390915d7c21b67d8e52d8ff7ce1907765c525475f5fae4a6390bc827da7b678189f86515ffd0cd51373d68899c4e07c07f595d45db6c66106
SSDEEP 3072:DG3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQC:DgQ+IFCumUGekHRvEuO3go9kfnQ
TLSH
T104B3D012AE439D3FD4916738E9F75BBE7A75FAC14B6305838A10A4318FA27D054F231A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	4120	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PhotoHunt-32.exe

C:\Users\Admin\AppData\Local\Temp\PhotoHunt-32.exe
"C:\Users\Admin\AppData\Local\Temp\PhotoHunt-32.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 268
  2⤵
  - Program crash
  PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4120 -ip 4120
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4120-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download