e312ab46de3d10070877bda697fb6e9cdd5d3630c53ffe5665534870addc5a9f

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e312ab46de3d10070877bda697fb6e9cdd5d3630c53ffe5665534870addc5a9f.dll
Size 277KB
Sample260924-qm7djsed72
SHA256 e312ab46de3d10070877bda697fb6e9cdd5d3630c53ffe5665534870addc5a9f
MD5 c3c1feb120b961c61cb663a076dca813
SHA1 acb7071e3963b10e21b01690c98675a49d7b35fd
SHA512 45613a94cc2566e6eb4165ad7fb2a1ce5efdc8ddde2cc9d2d2b812d487e1ad242d2122d236d339f6fbf249dd90e0bdde1a15949934ff75e4093e058bd213b8c6
SSDEEP 3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15adYIgN2oyBOqy81N5bmUOgNmDqx5:PjdFKdoSxvixTxUAHIgN2/Z1NcU5xBb
TLSH
T1E354CFA175C4D037D0570039624FC77E5AB8FDF416B1A587BB841D96AE723A3EB2A203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	1408	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 1408	5792	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e312ab46de3d10070877bda697fb6e9cdd5d3630c53ffe5665534870addc5a9f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e312ab46de3d10070877bda697fb6e9cdd5d3630c53ffe5665534870addc5a9f.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 588
    3⤵
    - Program crash
    PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1408 -ip 1408
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads