3482490a0ec7ac541b445b9311cb8cea57e21ed97e76a89ee34e07e8eb02db44

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3482490a0ec7ac541b445b9311cb8cea57e21ed97e76a89ee34e07e8eb02db44.exe
Size 2.5MB
Sample260727-trbdfsxtds
SHA256 3482490a0ec7ac541b445b9311cb8cea57e21ed97e76a89ee34e07e8eb02db44
MD5 6a758b4dad3c6a1e00de5885d841b52a
SHA1 6d661e3c6a09e33981503c95b6128763b65bb320
SHA512 f6acb63c2ec1f0619afd2324688c9affcee6f8dcc6c96afc0af9cd3066f82c9f0055182bbf490db8c081c4c20b3d02c8166ccd9d090e486012935be4e6e6b876
SSDEEP 49152:rzORL0pTU2i727RZj3Fz+s8KuqGaX0ToIBAUZLYSm:WZiU2621ZCJBAUZL6
TLSH
T199C5C012F3A1C0F1E316207025BA2B3FA979DE551F2486C7B7D4FE690E722D096E6249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	5080	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3482490a0ec7ac541b445b9311cb8cea57e21ed97e76a89ee34e07e8eb02db44.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5080	3482490a0ec7ac541b445b9311cb8cea57e21ed97e76a89ee34e07e8eb02db44.exe
5080	3482490a0ec7ac541b445b9311cb8cea57e21ed97e76a89ee34e07e8eb02db44.exe

C:\Users\Admin\AppData\Local\Temp\3482490a0ec7ac541b445b9311cb8cea57e21ed97e76a89ee34e07e8eb02db44.exe
"C:\Users\Admin\AppData\Local\Temp\3482490a0ec7ac541b445b9311cb8cea57e21ed97e76a89ee34e07e8eb02db44.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 744
  2⤵
  - Program crash
  PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5080 -ip 5080
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5080-0-0x0000000010000000-0x0000000010017000-memory.dmp

Download