4b00ed843249382c2d84806418f959ab84a6ba3b50cfa498a2566a56e354fe6d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:30

Target

05b24f87284b0d82d3e996cba21b6ab0N.dll
Size

4.6MB
MD5

05b24f87284b0d82d3e996cba21b6ab0
SHA1

4402b162da2d885bb27c7d0b3ae1b135d0fed197
SHA256

4b00ed843249382c2d84806418f959ab84a6ba3b50cfa498a2566a56e354fe6d
SHA512

2f0bcde12c422b4c9b7fa4434c39e3bda96b8f8bd2b48ded485e8b4354e60b84f289b0d86451df00e019d07ac38942bc0280617fd7300a96db9f9c7f5ab076a3
SSDEEP

98304:2u6vOjpN0H3zgdXgK3c8iBxFs2iqkyyMtFHzkYhAxcikKql3Wf:5Bpm2R3ZEtpz5ATkK63g

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	rundll32.exe
2740	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2740	2632	rundll32.exe	30
PID 2632 wrote to memory of 2740	2632	rundll32.exe	30
PID 2632 wrote to memory of 2740	2632	rundll32.exe	30
PID 2632 wrote to memory of 2740	2632	rundll32.exe	30
PID 2632 wrote to memory of 2740	2632	rundll32.exe	30
PID 2632 wrote to memory of 2740	2632	rundll32.exe	30
PID 2632 wrote to memory of 2740	2632	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05b24f87284b0d82d3e996cba21b6ab0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05b24f87284b0d82d3e996cba21b6ab0N.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2740-0-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2740-6-0x0000000073B2D000-0x0000000073DA9000-memory.dmp

Filesize
2.5MB

Download
memory/2740-9-0x0000000073B2D000-0x0000000073DA9000-memory.dmp

Filesize
2.5MB

Download
memory/2740-5-0x0000000073B10000-0x000000007424C000-memory.dmp

Filesize
7.2MB

Download
memory/2740-4-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2740-2-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2740-10-0x0000000073B10000-0x000000007424C000-memory.dmp

Filesize
7.2MB

Download