32b640f0d00e23277e624e7b942793ab87a304f66c5cc153d0ba151bf89904da

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qwt5.dll
Size

463KB
MD5

ed16a4fc709f978fbee4b51980a5f505
SHA1

6116da399f7ed2372ad7b5aa834e9961512ba956
SHA256

25287ecee762ae64b556a0d1a77b17b5ce5fbd9376a180532b2ff88ab63fc6c5
SHA512

338b12202cc71e7ccffbe04ad4fe9a9c90fcee5981c035544054e09ea6a195c1e5cb93d94e9fd5a6fe757c8b39e05f9ef59b44a700b8decb43445f1ce1accde6
SSDEEP

12288:JDhjzD9+g7oGshDB37k57Iu9Ja9PO9M5rrmfQIBoPDOAoF51UKySMqQv1c8Tm+Uu:BhjzD9+g7oGshDB37k57Iu9Ja9PO9M51

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
60	1988	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1988	2516	rundll32.exe	84
PID 2516 wrote to memory of 1988	2516	rundll32.exe	84
PID 2516 wrote to memory of 1988	2516	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qwt5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qwt5.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 704
    3⤵
    - Program crash
    PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1988 -ip 1988
1⤵
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads