Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 08:28

General

  • Target

    192ea848eef439a47bb67b4f0234eef7b1d16febf0a31e0605f7a73dfdc15afd.dll

  • Size

    120KB

  • MD5

    9a612219b2141a3139eec0bb806b5d40

  • SHA1

    5c79e6bfbc2f283b9071e7fb922a7c6e93dcff18

  • SHA256

    192ea848eef439a47bb67b4f0234eef7b1d16febf0a31e0605f7a73dfdc15afd

  • SHA512

    b76e9e51ef8507f8629b4db462b6b09a02da8b1c02019ac9940b178fe573eedf73cf61711bcdeddba4f6c6f7cb8b1c7a37dfaed89b3a5a46ebfc259d176b1ea8

  • SSDEEP

    3072:4EVBFCvUcap7MDIrv50uAg0FubbmVR+K:42/eZKAOW+K

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\192ea848eef439a47bb67b4f0234eef7b1d16febf0a31e0605f7a73dfdc15afd.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\192ea848eef439a47bb67b4f0234eef7b1d16febf0a31e0605f7a73dfdc15afd.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads