39c80d37b8660de480dc2daa131c39bbf090e7a9dbb737481850168f0baa84f7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39c80d37b8660de480dc2daa131c39bbf090e7a9dbb737481850168f0baa84f7.exe
Size 1010KB
Sample260910-q4nyjacr7t
SHA256 39c80d37b8660de480dc2daa131c39bbf090e7a9dbb737481850168f0baa84f7
MD5 baeb5e2a1674e225c59ed05932fca46a
SHA1 6864fce5fc64f90064f7bc453d65676594efbe02
SHA512 5ad59da826583105e9dc36ed45e52cc4f9108d1b28326ea1f904cdfff796225353abfd53f03e29c1d1064a8e7f2205ad4e8006cff4389e76ca28d1f1a2910a38
SSDEEP 24576:e9C0XrUMFDsTB6vGPG2LW+P+mzRe+rYsVb3Q8od7IrFst:e9C0Xgfe2DRe+rZVb3Q8oRIrY
TLSH
T120252334F2039070E06E5DF20ABB5940AF7B71324E792017EB88D6AB5E7B6D7E136590
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5064	1908	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39c80d37b8660de480dc2daa131c39bbf090e7a9dbb737481850168f0baa84f7.exe

C:\Users\Admin\AppData\Local\Temp\39c80d37b8660de480dc2daa131c39bbf090e7a9dbb737481850168f0baa84f7.exe
"C:\Users\Admin\AppData\Local\Temp\39c80d37b8660de480dc2daa131c39bbf090e7a9dbb737481850168f0baa84f7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 396
  2⤵
  - Program crash
  PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1908 -ip 1908
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1908-1-0x0000000000400000-0x000000000042D000-memory.dmp