054cd1cd939c43c9451fc7b0a3e7c04ad3f1cb34a1f29aab642d27c985c3b604

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
054cd1cd939c43c9451fc7b0a3e7c04ad3f1cb34a1f29aab642d27c985c3b604.exe
Size 196KB
Sample260916-wntfzaej21
SHA256 054cd1cd939c43c9451fc7b0a3e7c04ad3f1cb34a1f29aab642d27c985c3b604
MD5 5809ad5ad02c56af16c3c0ee97868daa
SHA1 e9183b55768e7322e926d138d2e7ab77725219f4
SHA512 0f58ea8d44baf2a85fd5dc3e99887c5af6ea598bd196cf58d38618e9e1c144e8ae7613ba46c49212423246019f373094c632112b23cce26d58f18cd4c1e09e48
SSDEEP 3072:Osxxi8HqpnOiZF2jif0Obzl9PHirc3morThK9GPySkxAp3Yv9PlHWv:5ODOiC2ca9PHir2K7SkxAp3cHo
TLSH
T173143A1D9223C8F58334D270FB73B5712456978CAB64CFEE09A3C4D8D4A176D2C97AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	460	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	054cd1cd939c43c9451fc7b0a3e7c04ad3f1cb34a1f29aab642d27c985c3b604.exe

C:\Users\Admin\AppData\Local\Temp\054cd1cd939c43c9451fc7b0a3e7c04ad3f1cb34a1f29aab642d27c985c3b604.exe
"C:\Users\Admin\AppData\Local\Temp\054cd1cd939c43c9451fc7b0a3e7c04ad3f1cb34a1f29aab642d27c985c3b604.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 224
  2⤵
  - Program crash
  PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 460 -ip 460
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/460-0-0x0000000000400000-0x0000000000432000-memory.dmp

Download