8547a5af3af12d41cc438726d360baa8ba276c070d6fc833c2607d44d9f30b11

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8547a5af3af12d41cc438726d360baa8ba276c070d6fc833c2607d44d9f30b11.dll
Size 479KB
Sample261101-sfl55swsft
SHA256 8547a5af3af12d41cc438726d360baa8ba276c070d6fc833c2607d44d9f30b11
MD5 0ef07ffe678c8f084f57a1db76dae321
SHA1 77fbb59bd312247bd5168d00dee94c067a26cef7
SHA512 49e761261017a208e61df58516235979cdc3299feb3e51c016b970a45b04479f9d700021583ddd6a488740a6b628d6821c91d7ead177a81574cb00a04fd065b8
SSDEEP 12288:jhGvixUAOv113YdKnj4uzwXU3CF6WnJaT:jhGvGOvEKnj4uzHY3Ja
TLSH
T172A4F0A13485D037C4570039621FC77F1BF9BDF406A19997BB9419AAAF72353EA2A303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5016	2364	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2364	2756	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8547a5af3af12d41cc438726d360baa8ba276c070d6fc833c2607d44d9f30b11.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8547a5af3af12d41cc438726d360baa8ba276c070d6fc833c2607d44d9f30b11.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 588
    3⤵
    - Program crash
    PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2364 -ip 2364
1⤵
PID:5260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads