960003970fc062552e16f72cc16b4d2a4c18856d602c7727c5801b7c63e2c7de

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
960003970fc062552e16f72cc16b4d2a4c18856d602c7727c5801b7c63e2c7de.exe
Size 754KB
Sample260916-tf8jtabf29
SHA256 960003970fc062552e16f72cc16b4d2a4c18856d602c7727c5801b7c63e2c7de
MD5 03989bf0364d4bbbb85e17286a0e65e4
SHA1 d4591e4f51ac7c7313f5a28a4eeca63de6e174d1
SHA512 01fb9a5b67a6dca72b3df3899537235defe93877d320686b0f1837b03b2839590cdc3cd15a3ff423e574b50839a5c6151017209977123673f5575696c9878b3a
SSDEEP 12288:WsCxvR3hxCwEQ7U1GBj09IdFlxUlvjosTdcG93mHxtlvjosTdcG930xtlvjosTdT:WsCx5xUwQMGlvjRhFclvjRhFAlvjRhFB
TLSH
T119F401B0397DDC66F6AB343D18C69A844325FC658B2169CF30863BC968BA3D215753E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3684	8EF.tmp

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3756	3684	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	960003970fc062552e16f72cc16b4d2a4c18856d602c7727c5801b7c63e2c7de.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8EF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3684	2500	960003970fc062552e16f72cc16b4d2a4c18856d602c7727c5801b7c63e2c7de.exe	86

C:\Users\Admin\AppData\Local\Temp\960003970fc062552e16f72cc16b4d2a4c18856d602c7727c5801b7c63e2c7de.exe
"C:\Users\Admin\AppData\Local\Temp\960003970fc062552e16f72cc16b4d2a4c18856d602c7727c5801b7c63e2c7de.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\8EF.tmp
  "C:\Users\Admin\AppData\Local\Temp\8EF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\960003970fc062552e16f72cc16b4d2a4c18856d602c7727c5801b7c63e2c7de.exe FAB108404186019E4233F14238A088CF188D4A169676BC290BD90826EFB25CAC308D4CE16C39A16F28F650A44529A08A6519DD39A21B4534D83A4528A8052BDA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 464
    3⤵
    - Program crash
    PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3684 -ip 3684
1⤵
PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\8EF.tmp
Size 754KB
SHA256 526523532ba0e22646964c6bd3ab436e9a5531a09e75e27374ba6ee9186a3323
MD5 eb865ace2263b835b47c2ce05ff49a2c
SHA1 ebbf5407fc1820033c5ae68e69407bd68b018cb8
SHA512 dc0282074f40f4731faecb6e8987a0e097b6cec36d3e97475bcd8c6e0e6bd6f01a1c18547df63c62603c773f3052f2d7455edda88fe79c0a5e1f97981d37da94
SSDEEP 12288:WsCxEgoxE7qafZ79ma0LxUlvjosTdcG93mHxtlvjosTdcG930xtlvjosTdcG937:WsCx5oxsNx9maXlvjRhFclvjRhFAlvjr
TLSH
T174F401B0356CDC22F6AB313D09CA8A885329FC65975169CF31467BCDACBA3D205762C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download