7c015c13e9d6f1cf8d26c83ba542783482791c6e461e630c74f62a39d69e2601

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
release/experimental/x86/steamclient.dll
Size 90KB
Sample261024-yek5caff73
SHA256 7c015c13e9d6f1cf8d26c83ba542783482791c6e461e630c74f62a39d69e2601
MD5 755a230d800a32965f5aca383cf32fb1
SHA1 5e00b3394ee32d6536c6e3d033a7ed8716c879b1
SHA512 c719a67205374b91ac397c4d721410bf138e992316db46adf84fca1b7c841bef9c8cf33459b7cdb085a0b5f056b5c69c541e4a4e668e5dadd6389432ddd88a44
SSDEEP 1536:Ul29+6H+1lv3fzMVE/3jY+WNG1egQfHb19b7y0pI85wsW+Fcdwzv8FMCCmk7uZtP:k29+VR3fV/3ZWCegQfH/7yAI8Mw4FMCP
TLSH
T1DE93280075D0F175D9BED9354B38BA65CB2EB850DB90DDEB275402AA4E302C1EE31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	3500	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 3500	836	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\release\experimental\x86\steamclient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\release\experimental\x86\steamclient.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 916
    3⤵
    - Program crash
    PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3500 -ip 3500
1⤵
PID:980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

configs.user.ini

Path C:\Users\Admin\AppData\Roaming\GSE Saves\settings\configs.user.ini
Size 422B
SHA256 0adf472218ce9f37fd56cba4efc9a37f0d9c0eece00dd2a30859763394c55a68
MD5 0540434ac69be9c1ca63e1e8221a9a53
SHA1 a6e60b63b950703022b997850216730a0a0276fe
SHA512 3fee11f1873d0a9d7b8d90f8eb182cd1dc471fc72a2f0466be37f0d975fd50d9570c8c25bd28e10fb4c640f661ff21d8121b87056e015408f7e3b77313a7e03d
TLSH
T1C6E0F15A580729B61FB306B274DABEFE4F0E93DC09402D9D37D1231AA1A2CC29822B44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3500-0-0x000000006FCE0000-0x000000006FCF0000-memory.dmp

Download