640d78de80e5baf36667d646a6c5d8ea5b11cf2e8552a2f66660a589cdaa17ac

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
640d78de80e5baf36667d646a6c5d8ea5b11cf2e8552a2f66660a589cdaa17ac.exe
Size 4KB
Sample260826-vbss8ssfqe
SHA256 640d78de80e5baf36667d646a6c5d8ea5b11cf2e8552a2f66660a589cdaa17ac
MD5 5504326a6fabf3e4325786da2801d51f
SHA1 6385443d3b197e160b76062474c540b3002416f8
SHA512 05a7dfbef9f031f35f5cb577509f2439d5303bf127949c921404a61d34daa2fccfa52237438d8958bacd26cb805f99c745676edab7edf7eea0553c7737867cf3
TLSH
T193817242E7EC062BF1B7037C1AF343226678F5115A368B6E6988131A5D317604DE3BB1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3764	4268	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	640d78de80e5baf36667d646a6c5d8ea5b11cf2e8552a2f66660a589cdaa17ac.exe

C:\Users\Admin\AppData\Local\Temp\640d78de80e5baf36667d646a6c5d8ea5b11cf2e8552a2f66660a589cdaa17ac.exe
"C:\Users\Admin\AppData\Local\Temp\640d78de80e5baf36667d646a6c5d8ea5b11cf2e8552a2f66660a589cdaa17ac.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 816
  2⤵
  - Program crash
  PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4268 -ip 4268
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4268-0-0x0000000000720000-0x0000000000728000-memory.dmp

Download