Analysis

  • max time kernel
    16s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 07:21

General

  • Target

    d831e56bce1b1dc33733262854bca5f0N.exe

  • Size

    468KB

  • MD5

    d831e56bce1b1dc33733262854bca5f0

  • SHA1

    63ec03b156c7b06bf7bc3878378f22f194d90414

  • SHA256

    1f982377baac914debe6c9a1516b7a024a5ec9b6d9b70307abb78f9473950b3c

  • SHA512

    eb895ffc6ab7a36999910147fed1c84105ac7eca95d0a505dcbbffb36d1d87d3e149aabd662f974b4aa22d2a6a9305f0576c2f8acf91b801c09e587a14622e87

  • SSDEEP

    3072:KbCKog/nI95UtFYiPAtjcf8/qCMSCzgpacDHeGVf+lLI8mH6ukwlC:KbzoJ7UtbPsjcf9cETlLZc6uk

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d831e56bce1b1dc33733262854bca5f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\d831e56bce1b1dc33733262854bca5f0N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 236
      2⤵
      • Program crash
      PID:2376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads