eefcbb0334f8c2d7528ff69b02fdf0dadea85a367d8e4f133ddd6701d2557633

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eefcbb0334f8c2d7528ff69b02fdf0dadea85a367d8e4f133ddd6701d2557633.exe
Size 823KB
Sample260922-prs62stsdx
SHA256 eefcbb0334f8c2d7528ff69b02fdf0dadea85a367d8e4f133ddd6701d2557633
MD5 8aec80b815e93e0b0bcf34a6c28113b8
SHA1 b75a03abf2d780ac9ced3eab5d7eb330cb6c9ead
SHA512 d161bc7f28adb7b67d78b9956917eed71b53be2afabcadff100cb3321471b917e04576c6f06b96aa7a43887411bdae7c4d7c1236ee2ad7a7799a110d8082e297
SSDEEP 12288:vSOkAVYPZgtrltxtJow7tHwKpqGx3w5Bgt3v370:vSORVYwrl9/xHlpqGx3yyPI
TLSH
T138055A27A246613FE45E0A398573D24F9A3E67E0F5138866E3F40C4CCF265E7293E646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery installer

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3264	3004	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eefcbb0334f8c2d7528ff69b02fdf0dadea85a367d8e4f133ddd6701d2557633.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3004-0-0x0000000000830000-0x0000000000906000-memory.dmp	innosetup

C:\Users\Admin\AppData\Local\Temp\eefcbb0334f8c2d7528ff69b02fdf0dadea85a367d8e4f133ddd6701d2557633.exe
"C:\Users\Admin\AppData\Local\Temp\eefcbb0334f8c2d7528ff69b02fdf0dadea85a367d8e4f133ddd6701d2557633.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 400
  2⤵
  - Program crash
  PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3004 -ip 3004
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-0-0x0000000000830000-0x0000000000906000-memory.dmp

Download