19ac25f9d969dcdd7ac1fb92a72c568d6080bbe1ffa3073c0a3a9dca541bf91b

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/Dialer.dll
Size

4KB
MD5

b5be0e441e04e5bf077a90097b169d22
SHA1

22fdf908102ae4f45e45b354e2f28a9ac17eb684
SHA256

7f267c0c300ee645624dbff22329d8a1e86c2e147ee803a34c43bdee76da0255
SHA512

3cfc02b01e67cea80354de4725ec66fc1314ef68ec577a2d6f9f9bb6f8c450c777fd3ce32c21a59b935b401151221d1506d7c795dcd4e59edcf9d6a15b14c2d6

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	2556	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2556	1656	rundll32.exe	29
PID 1656 wrote to memory of 2556	1656	rundll32.exe	29
PID 1656 wrote to memory of 2556	1656	rundll32.exe	29
PID 1656 wrote to memory of 2556	1656	rundll32.exe	29
PID 1656 wrote to memory of 2556	1656	rundll32.exe	29
PID 1656 wrote to memory of 2556	1656	rundll32.exe	29
PID 1656 wrote to memory of 2556	1656	rundll32.exe	29
PID 2556 wrote to memory of 2972	2556	rundll32.exe	30
PID 2556 wrote to memory of 2972	2556	rundll32.exe	30
PID 2556 wrote to memory of 2972	2556	rundll32.exe	30
PID 2556 wrote to memory of 2972	2556	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 232
    3⤵
    - Program crash
    PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads