16fbbb8ca87800dc66c15f5f07df86d524627ed4464a4fdf06683f0e34349794

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DNF洋洋V1.19/spacewp.dll
Size

20KB
MD5

4a157413b45164b775c7c065d243f714
SHA1

cc43d98b5b311e16076f4ddc900aeaf9014b593b
SHA256

1557fcab9413dfd8f728b41b6f0482ef506104c8a1b97523a5d98706c4b19062
SHA512

557f18494556f10a4160b35a3ff5fa7d4a253866d54da835a5fe054b0ff479d7c39cb5f8cdffd29c4f4d6b96e7520036c90c7fae8c39b838a22fabb628637e9b
SSDEEP

48:a0d87pH07wEfsgm1Pc2PLzvYDkKu8y94pIRRbugMpu9DhfcB7:x0H08E0gmm/ppI7KgBXcB7

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	2372	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2372	4764	rundll32.exe	84
PID 4764 wrote to memory of 2372	4764	rundll32.exe	84
PID 4764 wrote to memory of 2372	4764	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DNF洋洋V1.19\spacewp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DNF洋洋V1.19\spacewp.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 636
    3⤵
    - Program crash
    PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2372 -ip 2372
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...