4b08d90e7241a009096105b2d8254d9dd10b0c9eadccf113069416c8c64a3906

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
10/08/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ghost Recon Wildlands Trainer/EasyAntiCheat/EasyAntiCheat_x86.dll
Size 3KB
Sample260810-wemxtsek7t
SHA256 4b08d90e7241a009096105b2d8254d9dd10b0c9eadccf113069416c8c64a3906
MD5 a793fcbbf8289f3632ed6b1b62d544c6
SHA1 7f24b8a37e237a94a3865c5887a2d4afc5624a72
SHA512 6698516be0d53676dcabb83e31302f731c9f23a3e6e89109b74fec9fb9d9b103ca9d7af163e0e10b434ba40ab86a690b1bdccdb59d8fbbd11e2294c256bc30f7
TLSH
T1C051DA2337B121B1D9AD17B02B574866A6BBA22003F1C99C1FC10E191DB504BBE30F15
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	2876	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2876	3048	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Ghost Recon Wildlands Trainer\EasyAntiCheat\EasyAntiCheat_x86.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Ghost Recon Wildlands Trainer\EasyAntiCheat\EasyAntiCheat_x86.dll",#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 608
    3⤵
    - Program crash
    PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2876 -ip 2876
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads