82d23d6669622f9fd291871d0689a862f8f71b948eec60fc401dfccfe2c30c56

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/08/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Creative EAX Setting_Slayed.exe
Size 1.5MB
Sample260821-t3lzbstdna
SHA256 82d23d6669622f9fd291871d0689a862f8f71b948eec60fc401dfccfe2c30c56
MD5 252393f5f4131d6e837e503a97367528
SHA1 ecaf0571bd3bdb8eaf16070e36216ba15aa89a79
SHA512 007c41053b3b1b102b4053fbd4bc2b0a0538fddcf257b2224cd203bbe105b91d4e5d0bbec40b88960a9ce28711f44716c3af49c197c62f918ee8f06ad089cfbc
SSDEEP 49152:6uxgaMj3XRD+uj3H2Cuk1+Lda3Wvho0o5J6ojxBiijQij:60DMj3XZ+ujX2Cuk1+Lda3Wvho18ijQa
TLSH
T1437539D2E94488D5F92D05B2A4269DB016A32D7EEDF4A49D68CABC2765B3343103FC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	836	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Creative EAX Setting_Slayed.exe

C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting_Slayed.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 904
  2⤵
  - Program crash
  PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 836 -ip 836
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-0-0x00000000004F0000-0x000000000067E000-memory.dmp

Download

memory/836-1-0x00000000057D0000-0x0000000005D76000-memory.dmp

Download

memory/836-2-0x0000000005110000-0x00000000051A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads