93bbb10646d2e426ac942850456aeab7198ede89120706a428d2a0becd56f10b

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93bbb10646d2e426ac942850456aeab7198ede89120706a428d2a0becd56f10b.dll
Size 1.0MB
Sample260923-1erm8sdf69
SHA256 93bbb10646d2e426ac942850456aeab7198ede89120706a428d2a0becd56f10b
MD5 7f19590eb4a54449dfe4e45645cbb731
SHA1 6919fc50bfc42f61f495c825543b293a6ccffb2a
SHA512 8243abc604b789d86a76f372e48d2f1a5f396bcc832e9bec97614a48bb65e22eb2e1c5602b3325c39aaad6e884ff25e649cce539510291c3ad0bb74deecf26a8
SSDEEP 12288:j66LRMHey2l6dr2V80N8Yvz9IM0DnAUNCI5tPizbsJgxKqD/oJ/dmzGLSdthLr3t:j4r2V1NNryCi6scK0oTWdT33ZitmrC
TLSH
T1C2356C21F242D1F5C4923272957BF7BB633C66171B2E26DB63C81F1C29381D1AE690A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	4500	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 4500	2480	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93bbb10646d2e426ac942850456aeab7198ede89120706a428d2a0becd56f10b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93bbb10646d2e426ac942850456aeab7198ede89120706a428d2a0becd56f10b.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 524
    3⤵
    - Program crash
    PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4500 -ip 4500
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4500-0-0x00000000100D0000-0x00000000100D1000-memory.dmp

Download