8bf0c44c27a9deb9a098b0ef276600ff02716bc4401985b9bb9ce76c2041ff13

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8bf0c44c27a9deb9a098b0ef276600ff02716bc4401985b9bb9ce76c2041ff13.exe
Size 3.6MB
Sample260908-krvmnaec93
SHA256 8bf0c44c27a9deb9a098b0ef276600ff02716bc4401985b9bb9ce76c2041ff13
MD5 0847ee3af0f92bc099a9443cac1e3973
SHA1 685b8dccb083f08258dedaf134e3e923697baddf
SHA512 d2b097666d9a84457c8e4ca8a5d0eb9eb702afa27bbf10287920f7b314bf68a1f8bccc960e2dcdd58cb498eaebcaa07ce1d9565089e44dcb2a62f774ba027dc1
SSDEEP 49152:z08OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJXe9emEPGKOPkQThMYRMnm7LBX:z08vdsGaQNgS1C6e6ngKpq
TLSH
T11106BE12BA828472F5930271957EAB7B48BDFA304B3585D7D3E41A5E5D301E23B3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4148	4072	WerFault.exe	85
4228	4072	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bf0c44c27a9deb9a098b0ef276600ff02716bc4401985b9bb9ce76c2041ff13.exe

C:\Users\Admin\AppData\Local\Temp\8bf0c44c27a9deb9a098b0ef276600ff02716bc4401985b9bb9ce76c2041ff13.exe
"C:\Users\Admin\AppData\Local\Temp\8bf0c44c27a9deb9a098b0ef276600ff02716bc4401985b9bb9ce76c2041ff13.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 584
  2⤵
  - Program crash
  PID:4148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 604
  2⤵
  - Program crash
  PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4072 -ip 4072
1⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4072 -ip 4072
1⤵
PID:724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-0-0x0000000000910000-0x0000000000CBD000-memory.dmp

Download

memory/4072-1-0x0000000000910000-0x0000000000CBD000-memory.dmp