ed627593e58641acbbb8618e215690dce783c3ba371b010a4885729001c8a8bf

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed627593e58641acbbb8618e215690dce783c3ba371b010a4885729001c8a8bf.exe
Size 827KB
Sample260815-mbgf7stfle
SHA256 ed627593e58641acbbb8618e215690dce783c3ba371b010a4885729001c8a8bf
MD5 c9d42524993d42b4a07a0bbe5d68472e
SHA1 635e7904e2b3a654e75e0addb1f9539a7795d0a0
SHA512 549bedad08598b5843586f4e0410436bd20feec5c0d34336ccdf941b014172af86a3abe43f9f9a248d9f771a913df74784fd234cec31378fa221a592c9f5a098
SSDEEP 12288:Uy9b7e7qwr52idQoHUtyFKVWf0371kKfUit/3v37An:Uy9Xe7qhilHqyFlf03xkcP6
TLSH
T133053A126246A63FF06A1B398423D313983DB7A575128C96E7F419CCCF263E3193EA57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery installer

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3368	5832	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed627593e58641acbbb8618e215690dce783c3ba371b010a4885729001c8a8bf.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5832-0-0x0000000000360000-0x0000000000437000-memory.dmp	innosetup

C:\Users\Admin\AppData\Local\Temp\ed627593e58641acbbb8618e215690dce783c3ba371b010a4885729001c8a8bf.exe
"C:\Users\Admin\AppData\Local\Temp\ed627593e58641acbbb8618e215690dce783c3ba371b010a4885729001c8a8bf.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 400
  2⤵
  - Program crash
  PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5832 -ip 5832
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5832-0-0x0000000000360000-0x0000000000437000-memory.dmp

Download