a4828025a0a5077c2c56342876650a56225ce162ef1f45f48b2fd6e3e971bcdd

Analysis

max time kernel
69s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

65a35ea7d0c83a17bd0065d0747700e0N.exe
Size

472KB
MD5

65a35ea7d0c83a17bd0065d0747700e0
SHA1

afc64c9e2a7b6cd37bce2d18cc54862ac16600ea
SHA256

a4828025a0a5077c2c56342876650a56225ce162ef1f45f48b2fd6e3e971bcdd
SHA512

773d86ee7db39d8c47c1aec2ec2f7ac5953155cc6f9cc727377f211015c4a7b0007f1b9bb4a42efb6db83992e309bb53fe64c010491493b6671491236e8626b1
SSDEEP

3072:Fq8RinudiP52xx67lLdfiHDoilsXxltI+Lp9:FHkgiPA6RBPilsB8Mp9

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	2828	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65a35ea7d0c83a17bd0065d0747700e0N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2396	2828	65a35ea7d0c83a17bd0065d0747700e0N.exe	30
PID 2828 wrote to memory of 2396	2828	65a35ea7d0c83a17bd0065d0747700e0N.exe	30
PID 2828 wrote to memory of 2396	2828	65a35ea7d0c83a17bd0065d0747700e0N.exe	30
PID 2828 wrote to memory of 2396	2828	65a35ea7d0c83a17bd0065d0747700e0N.exe	30

C:\Users\Admin\AppData\Local\Temp\65a35ea7d0c83a17bd0065d0747700e0N.exe
"C:\Users\Admin\AppData\Local\Temp\65a35ea7d0c83a17bd0065d0747700e0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 36
  2⤵
  - Program crash
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download