1390254e815bcf8b165746e61b75c33a67be98a927def1c0dcd9af10da66d9fc

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 01:07

Target

d3d11.dll
Size

760.0MB
MD5

4c73b7d9eb09095899cdff6785d4f8a4
SHA1

2a9a608bf6b005d655e3e3e19baab52928bb2795
SHA256

d7281141c92ebbaa12bfee27006325950be3121fede3d74fb68540b2babf402b
SHA512

ffbd5fc43d9c44c238d95f384071519596d0a0e8a35b66dded2baed25433fc30118bb2f6d4830116140c6dd483941478e3c9b4df35207051a1132ea3d65ded41
SSDEEP

196608:VnAO4YLd6cBToqh+/plnAO4YLd6cBToqh+/p:tAO46d6cBToqk/rAO46d6cBToqk/

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

rundll32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2156 wrote to memory of 2484	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2484	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2484	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2484	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2484	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2484	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2484	2156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d11.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d11.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2484

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2484-1-0x000000001F8AD000-0x000000001F8CC000-memory.dmp

Filesize
124KB

Download
memory/2484-0-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2484-2-0x000000001F8AD000-0x000000001F8CC000-memory.dmp

Filesize
124KB

Download