c78ecb29e9500df878fa589fcfeba3f7e53e7e4169823455494c214f0ee4cb72

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c78ecb29e9500df878fa589fcfeba3f7e53e7e4169823455494c214f0ee4cb72.exe
Size 616KB
Sample260726-29ms7ssxes
SHA256 c78ecb29e9500df878fa589fcfeba3f7e53e7e4169823455494c214f0ee4cb72
MD5 0b95027d6154528947e0abbb4ab3f564
SHA1 70be3c7c9b495ffb9cf1518141d0d78cf6384e1a
SHA512 7e82e7637c23896c2b375a2887651073cf37d619a1e116b72ce9ab2ae231d93f0ce3f29e0ccbae1860ed02bcad399a8f4b78fe38cf004377eaa12788869e9c1c
SSDEEP 6144:97wGDukHgqehOEUbBgH1onbVhm3gBC1OUdK8N+VQs7PlWlBjPKXPXwboCTms51tp:Sqj81OYKPlWlBjifyPTmfW7fO
TLSH
T14BD48D619DF0D418EC3AD6F0AABB55319F015673D6671BB4828630AFCBB146F2C9838D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4380	3820	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c78ecb29e9500df878fa589fcfeba3f7e53e7e4169823455494c214f0ee4cb72.exe

C:\Users\Admin\AppData\Local\Temp\c78ecb29e9500df878fa589fcfeba3f7e53e7e4169823455494c214f0ee4cb72.exe
"C:\Users\Admin\AppData\Local\Temp\c78ecb29e9500df878fa589fcfeba3f7e53e7e4169823455494c214f0ee4cb72.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 260
  2⤵
  - Program crash
  PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3820 -ip 3820
1⤵
PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3820-0-0x0000000000400000-0x000000000049F000-memory.dmp

Download