a4d3ed254857b83671e145a2960ea47bcf8ed1c9d5b3daef416aabdbda0c5a46

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4d3ed254857b83671e145a2960ea47bcf8ed1c9d5b3daef416aabdbda0c5a46.exe
Size 5KB
Sample260817-vbf5faem6z
SHA256 a4d3ed254857b83671e145a2960ea47bcf8ed1c9d5b3daef416aabdbda0c5a46
MD5 72cc411aa4aefed99f2b902f0a3ca765
SHA1 570517097b854326c4afc7636247108b9650d202
SHA512 8eace159066d1524309b2dc050aae6b7942453c82653385445eb299428e814268b19f70477a36b75203dd0c78008133b3599051289a84024e2e3cc35c384c1df
SSDEEP 48:qkfjoDAiJwDASRrMBD5eZZUZL6Rx6DX19WH42dluMEtXu/6BNumRJM4ios5F3t+5:/bprRQBD4/U9VDX19B2dAtRy5FagQh5
TLSH
T1B5B1B65AC0E7E5E3C3AB82304392B50E25E9CB15C554878F5DEC332A87A3AE5A2171F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4800-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4800-1-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	4800	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4d3ed254857b83671e145a2960ea47bcf8ed1c9d5b3daef416aabdbda0c5a46.exe

C:\Users\Admin\AppData\Local\Temp\a4d3ed254857b83671e145a2960ea47bcf8ed1c9d5b3daef416aabdbda0c5a46.exe
"C:\Users\Admin\AppData\Local\Temp\a4d3ed254857b83671e145a2960ea47bcf8ed1c9d5b3daef416aabdbda0c5a46.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 256
  2⤵
  - Program crash
  PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4800 -ip 4800
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4800-0-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4800-1-0x0000000000400000-0x0000000000408000-memory.dmp