Analysis
- user interaction
yes - max time kernel
6s - max time network
10s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
03/08/2026, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Creative EAX Setting-cleaned.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Creative EAX Setting-cleaned.exe
Resource
win10ltsc2021-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Creative EAX Setting-cleaned.exe
Resource
win11-20260513-en
2 signatures
150 seconds
General
- Target Creative EAX Setting-cleaned.exe
- Size 340KB
- Sample260803-vn5csswvhw
- SHA256 104cb6bac233c92547be1c37ee8490b24aa2d56b15842b8b7cd21837a43f2411
- MD5 82099552a9040ffe8317620e4e313ab6
- SHA1 e42c05a6058567cc44701031aa66db0eb421c0b4
- SHA512 54b2ed99fc9f2e3a184cc6542d9cf1e422db2e44dda3106097930b88c50d29e82fb0d4c2c4377ddf260970ac55ea091749d398cf08aaa06cea692b92b3657f18
- SSDEEP 6144:PsjsjuFYLzin9/Mt+LfRAyk5DVc8YLzin92gLMAtDRNg4DOrIWipGA50mmVZ:vKFcs9kt+dOrcs9PLvDrg4DO/iX50mmz
- TLSH T12E74DFC5B2EC6C27CA3D19F1559B61D68BF2902729B2E4DC5DD931CA81ECF0809879CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 4576 3124 WerFault.exe 82 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Creative EAX Setting-cleaned.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting-cleaned.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 10442⤵
- Program crash
PID:4576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3124 -ip 31241⤵PID:5000