Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
d831e56bce1b1dc33733262854bca5f0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d831e56bce1b1dc33733262854bca5f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
d831e56bce1b1dc33733262854bca5f0N.exe
-
Size
468KB
-
MD5
d831e56bce1b1dc33733262854bca5f0
-
SHA1
63ec03b156c7b06bf7bc3878378f22f194d90414
-
SHA256
1f982377baac914debe6c9a1516b7a024a5ec9b6d9b70307abb78f9473950b3c
-
SHA512
eb895ffc6ab7a36999910147fed1c84105ac7eca95d0a505dcbbffb36d1d87d3e149aabd662f974b4aa22d2a6a9305f0576c2f8acf91b801c09e587a14622e87
-
SSDEEP
3072:KbCKog/nI95UtFYiPAtjcf8/qCMSCzgpacDHeGVf+lLI8mH6ukwlC:KbzoJ7UtbPsjcf9cETlLZc6uk
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2376 1744 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d831e56bce1b1dc33733262854bca5f0N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1744 d831e56bce1b1dc33733262854bca5f0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2376 1744 d831e56bce1b1dc33733262854bca5f0N.exe 29 PID 1744 wrote to memory of 2376 1744 d831e56bce1b1dc33733262854bca5f0N.exe 29 PID 1744 wrote to memory of 2376 1744 d831e56bce1b1dc33733262854bca5f0N.exe 29 PID 1744 wrote to memory of 2376 1744 d831e56bce1b1dc33733262854bca5f0N.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d831e56bce1b1dc33733262854bca5f0N.exe"C:\Users\Admin\AppData\Local\Temp\d831e56bce1b1dc33733262854bca5f0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 2362⤵
- Program crash
PID:2376
-