7006f1cfb03c7b2047241739b6aab6225b5c7746fdf8e56d607162c76de73ec9

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7006f1cfb03c7b2047241739b6aab6225b5c7746fdf8e56d607162c76de73ec9.exe
Size 3.1MB
Sample260718-gttllah16k
SHA256 7006f1cfb03c7b2047241739b6aab6225b5c7746fdf8e56d607162c76de73ec9
MD5 65883b8f8cd9b44767c67605f8a4fd8e
SHA1 901031a6bc30f8160b096ddd3ab7ce36137507e4
SHA512 df7900b3a66ea6f30f3c77007645b8708265dac4c36de755abbab2cf8b91c14cb1487a6bab1c2f5749b155e1eb3ae0ebe268da83188bbafd91667261bd9df61f
SSDEEP 768:KTz0insEdhh0I9VXSKyP4VQxgNFTOrotqY:6/nsOZTyP42xg2roUY
TLSH
T1B9E5098A73BE4C5FF0A90F302CF59A068696F95528354D5E2A84478F1F6C3C2C81DF62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 3 IoCs

pid	pid_target	Process	procid_target
792	1936	WerFault.exe	88
4160	1936	WerFault.exe	88
4200	1936	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7006f1cfb03c7b2047241739b6aab6225b5c7746fdf8e56d607162c76de73ec9.exe

C:\Users\Admin\AppData\Local\Temp\7006f1cfb03c7b2047241739b6aab6225b5c7746fdf8e56d607162c76de73ec9.exe
"C:\Users\Admin\AppData\Local\Temp\7006f1cfb03c7b2047241739b6aab6225b5c7746fdf8e56d607162c76de73ec9.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 608
  2⤵
  - Program crash
  PID:792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 616
  2⤵
  - Program crash
  PID:4160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 612
  2⤵
  - Program crash
  PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1936 -ip 1936
1⤵
PID:5352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1936 -ip 1936
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1936 -ip 1936
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x000000000052F000-0x0000000000530000-memory.dmp

Download