cf3f835607db6ea48f3cc80bef6a6216c12a425f2d1b531a8fa773166a97642c | Triage

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

BCP47Langs.dll
Size

281KB
MD5

949a643bfeded5b9fcf4ddc6f558fec2
SHA1

58a55cf4745b43451473ed554db5defed07f1546
SHA256

cf3f835607db6ea48f3cc80bef6a6216c12a425f2d1b531a8fa773166a97642c
SHA512

08a79391b904c7b4524779b6bd800872a6b1d61ee4595fc3e7599c3935df273d4c2939641ce02ceda761fc7d0326f829fedb4b83e4160d6ecf7a1ea38195c5d6
SSDEEP

6144:mrb5NbAxwrSjNysh307ULpjsLksccxaRM/OZUEOAPPvPUWfL:mrb5NbUNtaUL33R2EhEWf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5056	2000	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 2000	3512	rundll32.exe	85
PID 3512 wrote to memory of 2000	3512	rundll32.exe	85
PID 3512 wrote to memory of 2000	3512	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BCP47Langs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BCP47Langs.dll,#1
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 600
    3⤵
    - Program crash
    PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2000 -ip 2000
1⤵
PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads