Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-09-2024 07:43
Static task
static1
Behavioral task
behavioral1
Sample
c2cc7e77a5002bf7512c072b9ac4e230N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c2cc7e77a5002bf7512c072b9ac4e230N.exe
Resource
win10v2004-20240802-en
General
-
Target
c2cc7e77a5002bf7512c072b9ac4e230N.exe
-
Size
39KB
-
MD5
c2cc7e77a5002bf7512c072b9ac4e230
-
SHA1
a39c5edc1653da0e9dec0d4f09df1dd4e93dd53d
-
SHA256
45fc0ad2155a7cd2c3d048a0c3e7e8f965ae44696dbe775d6749dc5da0203c43
-
SHA512
bf674e45bcf4cac65a3bff437418d5917dbda5386911c5e690c4e6b642a5d310fe632f9ce657e9e496ad6c56dc487524ee871d4b1e15b5339a9ca0c3d659ba06
-
SSDEEP
768:uLNJJkw4H7P8PBZd+/bEcK7l2H8AvxIEwe:u1kVDWZEbEcZcQD
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2240 1688 WerFault.exe 27 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c2cc7e77a5002bf7512c072b9ac4e230N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2240 1688 c2cc7e77a5002bf7512c072b9ac4e230N.exe 28 PID 1688 wrote to memory of 2240 1688 c2cc7e77a5002bf7512c072b9ac4e230N.exe 28 PID 1688 wrote to memory of 2240 1688 c2cc7e77a5002bf7512c072b9ac4e230N.exe 28 PID 1688 wrote to memory of 2240 1688 c2cc7e77a5002bf7512c072b9ac4e230N.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2cc7e77a5002bf7512c072b9ac4e230N.exe"C:\Users\Admin\AppData\Local\Temp\c2cc7e77a5002bf7512c072b9ac4e230N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 962⤵
- Program crash
PID:2240
-