a08c6fe5feddbb534659baf002c244c173e03aa947bc30dba1f698ff841b21a9

Resubmissions

22/09/2026, 11:03

260922-m5xqaavajb1

22/09/2026, 11:00

260922-m4e4vacf763

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Downloader.dll
Size 199KB
Sample260922-m4e4vacf76
SHA256 a08c6fe5feddbb534659baf002c244c173e03aa947bc30dba1f698ff841b21a9
MD5 74a68460ddc67986a5045a2fb1aae374
SHA1 bb2c3d04ea96fe59f997c310b345189d308a864b
SHA512 a2a43cb924b64e798561f14a9c0fbae8bf777af42496f290e61faa60a56513d0d78fd54175b978e54ecd2560a36c898739dd6b3679783f4d0e5932d70d2de5ed
SSDEEP 6144:Ej4UFGJ+RglWkyWw7KU9evkCEnoP143DyZgQ:24M5kfOKbEl3DySQ
TLSH
T115148C16E78060BED6FB3570113B6F3568BE9B352F908DC313648952A9307C4DA3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2384	3488	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3488	2832	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Downloader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Downloader.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 636
    3⤵
    - Program crash
    PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3488 -ip 3488
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads