a01ee8a477e9313a5712a83832b2ba0da94b286c8f3833050270e1004e529155

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a01ee8a477e9313a5712a83832b2ba0da94b286c8f3833050270e1004e529155.dll
Size

3.5MB
MD5

0b7399925c0284616b9fdfec3d20fcad
SHA1

2511a97c723050bad7c35f6ae9674f33040e1f8c
SHA256

a01ee8a477e9313a5712a83832b2ba0da94b286c8f3833050270e1004e529155
SHA512

80bf5ab18eb6919af7a36e8deafb2e62e9cb03afa7f7ee1bf891708fb9349062449e117bdfa355d37e73e1a20f301b7f2c077ae0bc78d34439c3080c9bd2c3aa
SSDEEP

49152:BfNSyj01WjPC1pJqQ2mIaoA1QXnIjw28jfhxS99PxV3kS0FrQj7qDBs4L:BIyA1WbC1PqooAVjv5RxVUS0IM

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	5076	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 5076	852	rundll32.exe	84
PID 852 wrote to memory of 5076	852	rundll32.exe	84
PID 852 wrote to memory of 5076	852	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a01ee8a477e9313a5712a83832b2ba0da94b286c8f3833050270e1004e529155.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a01ee8a477e9313a5712a83832b2ba0da94b286c8f3833050270e1004e529155.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 672
    3⤵
    - Program crash
    PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5076 -ip 5076
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads