5428cae896558131a2a3409453663732f84754e8f4a7dc388b4b30659169eaba

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/nsExec.dll
Size 27KB
Sample260910-vm5xyavyfy
SHA256 5428cae896558131a2a3409453663732f84754e8f4a7dc388b4b30659169eaba
MD5 45a7b21d49191d42e93e5f47cb7cb26b
SHA1 5bed2652f85f0a5ba5b532f4e0099b9f1d527fe9
SHA512 248a91c563073bc92fa774515328ac8fde742eaf6bb6d140277251970e04cef9999114fc823e06c9b5f02fcb6becfe48c55fc91883f83f99bbc3b86d2cff2845
SSDEEP 768:yDrkoernAGRHYiDLk5ZtP7Yiq9f995AL3R:yDrko81H7MP77CiR
TLSH
T161C25C7388C02C45DC579D3074C4A83BEEB2A5951AD181D2722EC1A59B91783BBED2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	3768	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 3768	2544	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 612
    3⤵
    - Program crash
    PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3768 -ip 3768
1⤵
PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads