138cea48e6051c70a604e7f0b01579893cbb93ffc6c64a8f79dc38dff074942b

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
138cea48e6051c70a604e7f0b01579893cbb93ffc6c64a8f79dc38dff074942b.exe
Size 877KB
Sample260815-pbad1abl4v
SHA256 138cea48e6051c70a604e7f0b01579893cbb93ffc6c64a8f79dc38dff074942b
MD5 a5d9ed0cea8e82eb1d61f176426e4f0a
SHA1 11ece16e3b4f8895ed0a59c42a28965bd0bc3172
SHA512 632f7260f862e7a5746628710110e594bc6bf017eddf4b0a5a77b4ccc188f08ef7a5847e79735b6362b6257bc9af462ed45f533bb9080dd5c9c7f6bae66ef4cb
SSDEEP 12288:tPyF1lTiz2M/M6NYgPaMUrbXEKdXTYzZB+x3v379jP:VyF3iaSM6FPxUPXEAXszZGPtP
TLSH
T181153C1FE246613FF06A2A358573E22259B97B6164E38853D7FC344CCF391E4292E687
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery installer

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4664	4224	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	138cea48e6051c70a604e7f0b01579893cbb93ffc6c64a8f79dc38dff074942b.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4224-0-0x0000000000830000-0x0000000000914000-memory.dmp	innosetup

C:\Users\Admin\AppData\Local\Temp\138cea48e6051c70a604e7f0b01579893cbb93ffc6c64a8f79dc38dff074942b.exe
"C:\Users\Admin\AppData\Local\Temp\138cea48e6051c70a604e7f0b01579893cbb93ffc6c64a8f79dc38dff074942b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 400
  2⤵
  - Program crash
  PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4224 -ip 4224
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4224-0-0x0000000000830000-0x0000000000914000-memory.dmp

Download