5a5263feb2c725f2b94cdfd1e2d131a8263bdcb377f6b78b01c16a092426dc1f

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 15:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a5263feb2c725f2b94cdfd1e2d131a8263bdcb377f6b78b01c16a092426dc1f.dll
Size 203KB
Sample260802-szsr2assat
SHA256 5a5263feb2c725f2b94cdfd1e2d131a8263bdcb377f6b78b01c16a092426dc1f
MD5 5954bf17840fefb2afa823a9b496594e
SHA1 469391396b270ee9c9a98def227c3582eae99e4c
SHA512 1236cae556ee57591c63d10d1e9ca54787505bc06db3fd8709dfffc4afe61c1d7f1c63df8cbbd45c74010a4bd7328d67fa96e6a5350392f7ebedc11462a54e94
SSDEEP 6144:dD5WAs9NWsXiDndmbYYUNO+Qs0jiVZcU003orTh+eDDpKe9uXWUTJlOflLJlgh:DWAs9NWsXiDndmbYYUNO+Qs0jiVWU00j
TLSH
T125148DA13184E032E4570574A21EC77E9B7DFDF416359483BBD42A669F722A3EB29303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	1008	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1008	2544	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5263feb2c725f2b94cdfd1e2d131a8263bdcb377f6b78b01c16a092426dc1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5263feb2c725f2b94cdfd1e2d131a8263bdcb377f6b78b01c16a092426dc1f.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 476
    3⤵
    - Program crash
    PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1008 -ip 1008
1⤵
PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads