16fbbb8ca87800dc66c15f5f07df86d524627ed4464a4fdf06683f0e34349794

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DNF洋洋V1.19/spacewp.dll
Size

20KB
MD5

4a157413b45164b775c7c065d243f714
SHA1

cc43d98b5b311e16076f4ddc900aeaf9014b593b
SHA256

1557fcab9413dfd8f728b41b6f0482ef506104c8a1b97523a5d98706c4b19062
SHA512

557f18494556f10a4160b35a3ff5fa7d4a253866d54da835a5fe054b0ff479d7c39cb5f8cdffd29c4f4d6b96e7520036c90c7fae8c39b838a22fabb628637e9b
SSDEEP

48:a0d87pH07wEfsgm1Pc2PLzvYDkKu8y94pIRRbugMpu9DhfcB7:x0H08E0gmm/ppI7KgBXcB7

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2652	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2652	2648	rundll32.exe	31
PID 2648 wrote to memory of 2652	2648	rundll32.exe	31
PID 2648 wrote to memory of 2652	2648	rundll32.exe	31
PID 2648 wrote to memory of 2652	2648	rundll32.exe	31
PID 2648 wrote to memory of 2652	2648	rundll32.exe	31
PID 2648 wrote to memory of 2652	2648	rundll32.exe	31
PID 2648 wrote to memory of 2652	2648	rundll32.exe	31
PID 2652 wrote to memory of 2684	2652	rundll32.exe	32
PID 2652 wrote to memory of 2684	2652	rundll32.exe	32
PID 2652 wrote to memory of 2684	2652	rundll32.exe	32
PID 2652 wrote to memory of 2684	2652	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DNF洋洋V1.19\spacewp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DNF洋洋V1.19\spacewp.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 236
    3⤵
    - Program crash
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads