40d5009e7747408f7afa0ec1df19544a5bdd60086860ea591d83e0dfae975f0b

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40d5009e7747408f7afa0ec1df19544a5bdd60086860ea591d83e0dfae975f0b.exe
Size 844KB
Sample260722-whd44a1cle
SHA256 40d5009e7747408f7afa0ec1df19544a5bdd60086860ea591d83e0dfae975f0b
MD5 ad6eacd3c7035bba370be49f96c2a0a9
SHA1 b02b3b2d1553683170b5b5fa7acde00d81ffa183
SHA512 12cd17edc7f7794cd040ebdd25a04e5b7b5c4b21c284f2dc5c22780f5f4de5988c76af1f531984d884b4c21a6b5fef165831895f7c80b1e05d3b626b6d38ea3e
SSDEEP 768:NSrHErlELG5Ww95RJeeJawWEy5fFpTKewln4PSgInXBgPohaIWawH2kf0:NSgriL0TzO5fvzw26guwoYP3H8
TLSH
T123052C81D90AABE9C248A9BFA2D7FF1B655623171718F8C352240D54F6639F2A43C7C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5616	3664	WerFault.exe	87
1412	3664	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40d5009e7747408f7afa0ec1df19544a5bdd60086860ea591d83e0dfae975f0b.exe

C:\Users\Admin\AppData\Local\Temp\40d5009e7747408f7afa0ec1df19544a5bdd60086860ea591d83e0dfae975f0b.exe
"C:\Users\Admin\AppData\Local\Temp\40d5009e7747408f7afa0ec1df19544a5bdd60086860ea591d83e0dfae975f0b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 256
  2⤵
  - Program crash
  PID:5616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 260
  2⤵
  - Program crash
  PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3664 -ip 3664
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3664 -ip 3664
1⤵
PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads