Analysis

  • max time kernel
    141s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    17-08-2024 18:32

General

  • Target

    81411125/253 将数据库中的内容添加到OutLine控件中/Project2.exe

  • Size

    822KB

  • MD5

    129620bb318a2692e4826807aa52608b

  • SHA1

    03cdc87c6cc232091d62ff8830f58c40475d9753

  • SHA256

    f8d784381836028c608ff4265f7cd8c9c0882678c928550ae119e012d59f5112

  • SHA512

    e4f5cb9ee313b2f5918649833c88c408eb7d4acda32b5428f1ec3b92759bd34be9ec516f21691f8d962d3df30225649d7f4fdfc4ca8396b98f0e1c05db1e4898

  • SSDEEP

    12288:X3MirNxNByo1iz2mpqiSVsMuzTR+IP3Pg7/Z3WkOR+xm7+LSG12gA0H9tDItk8:siNxKzz29VsPFCEf++tk

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81411125\253 将数据库中的内容添加到OutLine控件中\Project2.exe
    "C:\Users\Admin\AppData\Local\Temp\81411125\253 将数据库中的内容添加到OutLine控件中\Project2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 232
      2⤵
      • Program crash
      PID:988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1732-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1732-2-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1732-1-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB