5d71e559b666bbc4a02a392c00efd236944eea7286c8be0b89193fce303f77c1

Analysis

max time kernel
136s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

浩方电竞平台5.6.0/AdsManager.dll
Size

128KB
MD5

fd052a1c828343e645f96bbe82bebed3
SHA1

54526b8a61763f6b4f31d62bc3f1eb9bd7389cc5
SHA256

0bf9eafe958745b21b024f4554406584af6ade51cc83da3827666f4c0ceed47c
SHA512

18394fbaa03b168bf3a7f3763a73b082382e50419875c24924033586b9d3fda8d6b9fb277da0b1f866a6467079397ae913b27ae6c01fe3cd33ee5b3d77b02b7d
SSDEEP

3072:NGXkziNjrutI3MIB8ZSvcH2/SaGwbIh+ez/kygmKVfUp/Rvq7uMeudvozO0h:AXEpzMNVfUp/XudQOo

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2400	4876	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4876	2616	rundll32.exe	86
PID 2616 wrote to memory of 4876	2616	rundll32.exe	86
PID 2616 wrote to memory of 4876	2616	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\浩方电竞平台5.6.0\AdsManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\浩方电竞平台5.6.0\AdsManager.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 604
    3⤵
    - Program crash
    PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4876 -ip 4876
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads