4589794f51264ec959e39714ecff8127375226f4f6a1205ca0631a8e57253d2b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4589794f51264ec959e39714ecff8127375226f4f6a1205ca0631a8e57253d2b.exe
Size 13KB
Sample260905-g4algavybt
SHA256 4589794f51264ec959e39714ecff8127375226f4f6a1205ca0631a8e57253d2b
MD5 70168e68797e586cc77b9b8ab5993b3c
SHA1 99390d0fbb3f936b2d4c62a13c6ba3e2ed33d91c
SHA512 194177777021c3c8eb0e74f47bbee9ef7a83a2b80fba252990919b4198cde08ffec01cf4e13c88c841c34d8ca9c53a8bf73417e2c48783a8eed9ff4aa33c1357
SSDEEP 192:fVQ5PAfGuY1orw4ZiIxvGf26GPPKFS5eZAHY4xhfjCgXKqihhcb2vukkqE:NQ5Ae2U4VxjvvDrkqQAKLE
TLSH
T1D9522A9C99A765B4CB46EAB422D279F639B4CD1263FA13910DCBAFFD237046310065F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	2340	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4589794f51264ec959e39714ecff8127375226f4f6a1205ca0631a8e57253d2b.exe

C:\Users\Admin\AppData\Local\Temp\4589794f51264ec959e39714ecff8127375226f4f6a1205ca0631a8e57253d2b.exe
"C:\Users\Admin\AppData\Local\Temp\4589794f51264ec959e39714ecff8127375226f4f6a1205ca0631a8e57253d2b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 264
  2⤵
  - Program crash
  PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2340 -ip 2340
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-0-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2340-1-0x0000000000400000-0x0000000000406000-memory.dmp