e16d85597c91b50a9b98fc67b7c02f504c89e99433a53a77e84094a70283225d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e16d85597c91b50a9b98fc67b7c02f504c89e99433a53a77e84094a70283225d.exe
Size 824KB
Sample260922-prs62stsdz
SHA256 e16d85597c91b50a9b98fc67b7c02f504c89e99433a53a77e84094a70283225d
MD5 71a9861d0a079736ac164a9de5333049
SHA1 554e3cef3e7c5085a55b96c8b50ac42c70d15936
SHA512 3deceb926d3d87f236d0efc1c0032ffab9bc4310f3e0efcdb450093ac0d7b19301aab6fee71850e2d0ece8e303263480d4d4a9ba9e427f4ac33c29049c85c662
SSDEEP 12288:HSOkAVYPZgtrltxtJow7tHwKpqGx3wMBbTt3v370:HSORVYwrl9/xHlpqGx33bpPI
TLSH
T198055A27A246613FE45E0A398573D24F9A3E67E0F5138866E3F40C4CCF265E7293E646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery installer

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	4512	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e16d85597c91b50a9b98fc67b7c02f504c89e99433a53a77e84094a70283225d.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4512-0-0x0000000000F30000-0x0000000001006000-memory.dmp	innosetup

C:\Users\Admin\AppData\Local\Temp\e16d85597c91b50a9b98fc67b7c02f504c89e99433a53a77e84094a70283225d.exe
"C:\Users\Admin\AppData\Local\Temp\e16d85597c91b50a9b98fc67b7c02f504c89e99433a53a77e84094a70283225d.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 400
  2⤵
  - Program crash
  PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4512 -ip 4512
1⤵
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4512-0-0x0000000000F30000-0x0000000001006000-memory.dmp

Download