7983afe2285a88ebc10231ad09bc3785f3a3f6af82a7c2e9b4b578c6282d6870

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7983afe2285a88ebc10231ad09bc3785f3a3f6af82a7c2e9b4b578c6282d6870.dll
Size 8.8MB
Sample260708-mdm2rset4v
SHA256 7983afe2285a88ebc10231ad09bc3785f3a3f6af82a7c2e9b4b578c6282d6870
MD5 9ed4781228746d8db5794cdcd8e3084f
SHA1 5cf34d3b98816327e939271f448936bfb1e35465
SHA512 49daf293b459ce5980820336e365877643e6ca9607a8d164bbcc143be914c691b01a34f622a809591319eb2aee51176a6a44cbd54518a44fa15e5fb8b3e6535f
SSDEEP 98304:g5cW70RR76oLflbfCFAQvNrRqhUtE04mYtCNcpo0892NjUBpWHHzzj:sQfdbCyQJJtZ4mYsmO08+oBpWHL
TLSH
T13A96CF22B78A263ED07B2B39587766509C3F7A733801CC4E4AF458CD8E755916E3AB07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	1144	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1144	2844	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7983afe2285a88ebc10231ad09bc3785f3a3f6af82a7c2e9b4b578c6282d6870.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7983afe2285a88ebc10231ad09bc3785f3a3f6af82a7c2e9b4b578c6282d6870.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 604
    3⤵
    - Program crash
    PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1144 -ip 1144
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-0-0x0000000002530000-0x0000000002E36000-memory.dmp

Download

memory/1144-1-0x0000000002530000-0x0000000002E36000-memory.dmp