c6e4f57741fe8ee35806a63b6bf0fe98c3a440c873a2aeb1fe56723da3111ada

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/nsis7z.dll
Size

467KB
MD5

c79d324f22f32cbafc30d38fc7a2a606
SHA1

ed15ed33d0611b307aac25609c2bc46f440a8869
SHA256

8af6113d196b7f54df6b2ca2cf923e0660a7f47bfe84cce4f8ec3777b53ac7e4
SHA512

a28644deb02e3324452c6bd74baf9c5925e0e980dd8db85b5a2db56f190eacd23782993fa1ec8ad791f23b2563f526958d7093f1409918f39115f641d2432617
SSDEEP

12288:cNZu4odeOo0QsjC4Fz74p87MZj/Ce/0jE:G/KeN0Jbh74S7ObCesjE

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	3176	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3176	2104	rundll32.exe	84
PID 2104 wrote to memory of 3176	2104	rundll32.exe	84
PID 2104 wrote to memory of 3176	2104	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 620
    3⤵
    - Program crash
    PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3176 -ip 3176
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads