15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe
Size

163KB
MD5

1de5ea65b2a23e8737429a09aa2cb150
SHA1

b2facb88bb3c8dbad76ebd4481a0a04e98ada640
SHA256

15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8
SHA512

3e7cc56cd565189b38bad82ccf5f20236eb57adb379e06a732167040ac57933a191cc3d5f4915c16d7b42916269df4b3f789ee1e5d85ed6ec73ce759e5e2c5ff
SSDEEP

3072:sweqOYEUXPn7qk0WINNKBC5CH+xF7vCww95YeoLoSqtIzp:NEUXeJ9KBC564ubYe5t

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	2972	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2352	2972	15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe	29
PID 2972 wrote to memory of 2352	2972	15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe	29
PID 2972 wrote to memory of 2352	2972	15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe	29
PID 2972 wrote to memory of 2352	2972	15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe	29
PID 2972 wrote to memory of 2352	2972	15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe	29
PID 2972 wrote to memory of 2352	2972	15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe	29
PID 2972 wrote to memory of 2352	2972	15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe	29

C:\Users\Admin\AppData\Local\Temp\15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe
"C:\Users\Admin\AppData\Local\Temp\15ce262c4b64c2d98dcaf7458bde72bcd18ebd081764e861170e4cc7f2fd46f8N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 264
  2⤵
  - Program crash
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-0-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2972-2-0x0000000000240000-0x000000000035D000-memory.dmp

Filesize
1.1MB

Download
memory/2972-3-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download