21bb8641ca88bbb9e54b3528e3f5bf518cdad2f515cae194461acea283db3e43

Analysis

max time kernel
141s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21bb8641ca88bbb9e54b3528e3f5bf518cdad2f515cae194461acea283db3e43.dll
Size

137KB
MD5

bf36c895824b2e5b946e6075c1f4ff4c
SHA1

f366c9ea7bc1ea8db582e0e6693031ab365d33cf
SHA256

21bb8641ca88bbb9e54b3528e3f5bf518cdad2f515cae194461acea283db3e43
SHA512

8f7950078cf981216621dce05d3ccc5856b7f3d3225f0f94c9e8bae35d9a84634091463de83576948d498f4c1430b0dc04882ca1ec1948f09de66a3e5d6c3ebe
SSDEEP

3072:HR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuj:625GgFny61mral

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	2224	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2224	3052	rundll32.exe	31
PID 3052 wrote to memory of 2224	3052	rundll32.exe	31
PID 3052 wrote to memory of 2224	3052	rundll32.exe	31
PID 3052 wrote to memory of 2224	3052	rundll32.exe	31
PID 3052 wrote to memory of 2224	3052	rundll32.exe	31
PID 3052 wrote to memory of 2224	3052	rundll32.exe	31
PID 3052 wrote to memory of 2224	3052	rundll32.exe	31
PID 2224 wrote to memory of 2692	2224	rundll32.exe	32
PID 2224 wrote to memory of 2692	2224	rundll32.exe	32
PID 2224 wrote to memory of 2692	2224	rundll32.exe	32
PID 2224 wrote to memory of 2692	2224	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21bb8641ca88bbb9e54b3528e3f5bf518cdad2f515cae194461acea283db3e43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21bb8641ca88bbb9e54b3528e3f5bf518cdad2f515cae194461acea283db3e43.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 232
    3⤵
    - Program crash
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000043E50000-0x0000000043E77000-memory.dmp

Filesize
156KB

Download