c1c5a3458ba7334dc6d351795ed58c87eebf8a42208e599305c6e87fb07027d5

Analysis

max time kernel
106s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75343077ab9f8fea67be4cb2c7a3b320N.exe
Size

468KB
MD5

75343077ab9f8fea67be4cb2c7a3b320
SHA1

afa285f8aa25488faa30c55db1285e31b25f7004
SHA256

c1c5a3458ba7334dc6d351795ed58c87eebf8a42208e599305c6e87fb07027d5
SHA512

bb00e91cdd2ef781002c7eb662bc94381b2f96aa128fab6ca636f270a27c40464822fe473e68484d1ce12e48b09b7bf41a2d0981fd207ebd9b5f9189b9c6dde6
SSDEEP

12288:fb7jkD3v0VBRxE5MBGlcM7UdTok7UZWG1j3FLiUhf:fb3w3v8BRqEM7UdhU1j35iI

Score

3^/10

discovery

Malware Config

Signatures

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3648	3656	WerFault.exe	75343077ab9f8fea67be4cb2c7a3b320N.exe
3220	3656	WerFault.exe	75343077ab9f8fea67be4cb2c7a3b320N.exe
4988	3656	WerFault.exe	75343077ab9f8fea67be4cb2c7a3b320N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

75343077ab9f8fea67be4cb2c7a3b320N.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75343077ab9f8fea67be4cb2c7a3b320N.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75343077ab9f8fea67be4cb2c7a3b320N.exe

C:\Users\Admin\AppData\Local\Temp\75343077ab9f8fea67be4cb2c7a3b320N.exe
"C:\Users\Admin\AppData\Local\Temp\75343077ab9f8fea67be4cb2c7a3b320N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 220
2⤵
- Program crash
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 228
2⤵
- Program crash
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 256
2⤵
- Program crash
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3656 -ip 3656
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3656 -ip 3656
1⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3656 -ip 3656
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3656-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3656-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download