abcad07ba99dfa5de1241b8dcec78cbb6829c97e78b637d681ba0bf71b836082

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
abcad07ba99dfa5de1241b8dcec78cbb6829c97e78b637d681ba0bf71b836082.dll
Size 334KB
Sample261102-wxvqdset7k
SHA256 abcad07ba99dfa5de1241b8dcec78cbb6829c97e78b637d681ba0bf71b836082
MD5 573d370802cd6381b738096e52b4fb6a
SHA1 9471eaf3c03f01a4b5d1eb677394e7a19aa0ab53
SHA512 b8e7167872206e7c5d894a0e44ce911461c593d737232ff34955a076811edb5831a00e4301b46dc41617cb7e3c077c9682c961bd6ba6d930e238b0d526b6b4c5
SSDEEP 6144:PjdFKdoSxvixTxUAqdxbBhcU5xO9zWM7t1Z6nO:jhGvixUA0bB14zNBn6O
TLSH
T19D74CFA13584D037D0570438625F877E5ABDFDF416B19983FF841A9AAE713A3E62A303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	3688	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3688	4116	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abcad07ba99dfa5de1241b8dcec78cbb6829c97e78b637d681ba0bf71b836082.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abcad07ba99dfa5de1241b8dcec78cbb6829c97e78b637d681ba0bf71b836082.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 588
    3⤵
    - Program crash
    PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3688 -ip 3688
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads