94b173a38b2be1235482e18ac2be7bc6ac35077c862695242ecef4bbfafd82d6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94b173a38b2be1235482e18ac2be7bc6ac35077c862695242ecef4bbfafd82d6.exe
Size 827KB
Sample260820-wgcvmsgm4t
SHA256 94b173a38b2be1235482e18ac2be7bc6ac35077c862695242ecef4bbfafd82d6
MD5 e07d87dedc9766ed68183c083f5bc19a
SHA1 8d0aacbc7bfb5221a37702af6da958b67d52ad86
SHA512 46b0c169ab495b80f4785d96ec35405c6b8fc8078ea8bb78b1583452a4ae22f818ed880ca4f8146c72b2775bfe295c09319fed2b26ddf93d98e04e5810be536b
SSDEEP 12288:SKcC+zA/uJ35Dv3SmeGveVULnU53v373:SKcRzAGJ3pfvveOLnKPD
TLSH
T156051913A247E53FF09F0A3D4576E223983A66A1652788ABD7F4084CDF791D12A3F346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery installer

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4132	3848	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94b173a38b2be1235482e18ac2be7bc6ac35077c862695242ecef4bbfafd82d6.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3848-0-0x0000000000A70000-0x0000000000B47000-memory.dmp	innosetup

C:\Users\Admin\AppData\Local\Temp\94b173a38b2be1235482e18ac2be7bc6ac35077c862695242ecef4bbfafd82d6.exe
"C:\Users\Admin\AppData\Local\Temp\94b173a38b2be1235482e18ac2be7bc6ac35077c862695242ecef4bbfafd82d6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 352
  2⤵
  - Program crash
  PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3848 -ip 3848
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3848-0-0x0000000000A70000-0x0000000000B47000-memory.dmp

Download