dd8ad032417a54a5e37f32d687f2e38b0a3df702975691df54e840e8c3dc18a5

Analysis

user interaction
yes
max time kernel
165s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PoolRooms-1.0.0 (1).exe
Size 7KB
Sample260722-xbbk3ascqd
SHA256 dd8ad032417a54a5e37f32d687f2e38b0a3df702975691df54e840e8c3dc18a5
MD5 f1fda15164eb26883489d15740c3b7df
SHA1 c01d80002d4d54c5be9c6c65a5338794003eaf4f
SHA512 a39302e4a754a884711c65b29a7f297b4807ced1b547143b776fe1a7d19a3b595e40e5c2dd4bfb5a50aa565b73d86b9dc29aaee39d3c5fe47663f67aa0afaf9d
SSDEEP 48:wo8DL6PgDqQB5Ca0+WZgTvIB2a6GlmsNkthOMUTiJnW8zZQBJgfFTU7A+j8U:N8fqQzCwuWvbth/UTitWsQv7f
TLSH
T1EBE145907EA8E04BC677F739B2F1AD2B82B1F653193E21050D88CEC51720135F528739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 3 IoCs

pid	pid_target	Process	procid_target
684	3996	WerFault.exe	80
2548	2288	WerFault.exe	88
1312	3776	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoolRooms-1.0.0 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoolRooms-1.0.0 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoolRooms-1.0.0 (1).exe

C:\Users\Admin\AppData\Local\Temp\PoolRooms-1.0.0 (1).exe
"C:\Users\Admin\AppData\Local\Temp\PoolRooms-1.0.0 (1).exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 276
  2⤵
  - Program crash
  PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3996 -ip 3996
1⤵
PID:1536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1592

C:\Users\Admin\AppData\Local\Temp\PoolRooms-1.0.0 (1).exe
"C:\Users\Admin\AppData\Local\Temp\PoolRooms-1.0.0 (1).exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 244
  2⤵
  - Program crash
  PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2288 -ip 2288
1⤵
PID:4056

C:\Users\Admin\AppData\Local\Temp\PoolRooms-1.0.0 (1).exe
"C:\Users\Admin\AppData\Local\Temp\PoolRooms-1.0.0 (1).exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 244
  2⤵
  - Program crash
  PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3776 -ip 3776
1⤵
PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3996-0-0x0000000000400000-0x0000000000404000-memory.dmp

Download