4013c4b0f1c8f71edbae130412e86d9db64f934372f27f86437f30e37a5765eb

Analysis

max time kernel
148s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__d263b7215a0aee64fa0b5c698a54b8ab.dll
Size 140KB
Sample260917-3lnahaed87
SHA256 4013c4b0f1c8f71edbae130412e86d9db64f934372f27f86437f30e37a5765eb
MD5 d263b7215a0aee64fa0b5c698a54b8ab
SHA1 1fc9db858d43a0de461f654f466c89f7803e86b9
SHA512 44eb2cfba9afa4f82612cd555f26f8a1c28ac20d57f3361e26dc8cd7276cc642d2b8e930e71639cf94c2c62ec7952da3835d282ce97a413c89dac0a1acb29e4c
SSDEEP 3072:c01as5ExiHYpaqQ0wX+RrhFCguxInlk7k6GwX:us5EkYXjrugkZ
TLSH
T1C0E3931922E65329F1F2AB700BBC617A99BABC1ADCB9D71D0240D95E1571A01DF30F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4864	3204	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3204	4256	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__d263b7215a0aee64fa0b5c698a54b8ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__d263b7215a0aee64fa0b5c698a54b8ab.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 556
    3⤵
    - Program crash
    PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3204 -ip 3204
1⤵
PID:548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3204-0-0x0000000002F50000-0x0000000002F75000-memory.dmp

Download