5ed4af9395ddf8fdfa4e9f190db2ede81d90d9c2ce97ade9cfa55e7dbb0b27a2

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ed4af9395ddf8fdfa4e9f190db2ede81d90d9c2ce97ade9cfa55e7dbb0b27a2.exe
Size 790KB
Sample260727-eycsjavydy
SHA256 5ed4af9395ddf8fdfa4e9f190db2ede81d90d9c2ce97ade9cfa55e7dbb0b27a2
MD5 32f9d53131f31ff686dee6ae1b133be6
SHA1 e4fc6e86d158127bd8e40763e136e76c7787fcb6
SHA512 a3aa8c36a5f14e55fba77ec57004b67771991acf3abb067f2e643165a9986f50ab56dd9f180bfda469b3138e470c9f40c05d157d2d210ce8b560f964140e2a4c
SSDEEP 12288:Un5cfiul/z3Jc10qkVuTGqm4dDmy1lBtE7RwRtN3Ers4+eXYWwf3Uipd:Wmfiul/z3Jc10qkVEmUBtE7mUw
TLSH
T136053A27B248613EC4AE26355773A120A97BBA91F816BD1677F0D40CCF7A1C02F3AE55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4928	1128	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ed4af9395ddf8fdfa4e9f190db2ede81d90d9c2ce97ade9cfa55e7dbb0b27a2.exe

C:\Users\Admin\AppData\Local\Temp\5ed4af9395ddf8fdfa4e9f190db2ede81d90d9c2ce97ade9cfa55e7dbb0b27a2.exe
"C:\Users\Admin\AppData\Local\Temp\5ed4af9395ddf8fdfa4e9f190db2ede81d90d9c2ce97ade9cfa55e7dbb0b27a2.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 404
  2⤵
  - Program crash
  PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1128 -ip 1128
1⤵
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Download