dd58c2bb7ffc0dc8e5b910ca30be4c032deb4972a7116f6f1633fdbef21da648

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/09/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d7b00e3ad8461bad8cae31335f1473f8f204136f6e1096f96854503124716df.exe
Size 322KB
Sample260915-gm9z1azthy
SHA256 dd58c2bb7ffc0dc8e5b910ca30be4c032deb4972a7116f6f1633fdbef21da648
MD5 d438e0627e2c5baae2f43dcb8559336e
SHA1 0f15f7993c95f4814cd4c7ee819ea60e65992b20
SHA512 29c3f62ceb639240d5da0d6db39552be37ddc3fa371b913bbf38507b02f755ee9ce5568c0fbc0899c42c40424e3035ea4fdabfe84aecaf94997566ae5543f36f
SSDEEP 6144:nUyD1Vzw/mvsV+IltcrqF5Fpg8VgcRG6l+wjkvARwbHNAhEoDnM1:nUyxVzgUO+cjF5FRRw6l+7owbOhEoA
TLSH
T15264CF6372B8F14EE4929B328F47C742C3A93F659846905A79A4230F2C76A544F74FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	5516	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d7b00e3ad8461bad8cae31335f1473f8f204136f6e1096f96854503124716df.exe

C:\Users\Admin\AppData\Local\Temp\1d7b00e3ad8461bad8cae31335f1473f8f204136f6e1096f96854503124716df.exe
"C:\Users\Admin\AppData\Local\Temp\1d7b00e3ad8461bad8cae31335f1473f8f204136f6e1096f96854503124716df.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 512
  2⤵
  - Program crash
  PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5516 -ip 5516
1⤵
PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5516-0-0x0000000000400000-0x0000000001C54000-memory.dmp

Download