f1a35e14ac13a6e686195edb94f749f4b256e74f38c03e450535765a179efcf7

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/Dialer.dll
Size

4KB
MD5

b5be0e441e04e5bf077a90097b169d22
SHA1

22fdf908102ae4f45e45b354e2f28a9ac17eb684
SHA256

7f267c0c300ee645624dbff22329d8a1e86c2e147ee803a34c43bdee76da0255
SHA512

3cfc02b01e67cea80354de4725ec66fc1314ef68ec577a2d6f9f9bb6f8c450c777fd3ce32c21a59b935b401151221d1506d7c795dcd4e59edcf9d6a15b14c2d6

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	784	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 784	1924	rundll32.exe	30
PID 1924 wrote to memory of 784	1924	rundll32.exe	30
PID 1924 wrote to memory of 784	1924	rundll32.exe	30
PID 1924 wrote to memory of 784	1924	rundll32.exe	30
PID 1924 wrote to memory of 784	1924	rundll32.exe	30
PID 1924 wrote to memory of 784	1924	rundll32.exe	30
PID 1924 wrote to memory of 784	1924	rundll32.exe	30
PID 784 wrote to memory of 2152	784	rundll32.exe	31
PID 784 wrote to memory of 2152	784	rundll32.exe	31
PID 784 wrote to memory of 2152	784	rundll32.exe	31
PID 784 wrote to memory of 2152	784	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 228
    3⤵
    - Program crash
    PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads