56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215

Analysis

max time kernel
12s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215.dll
Size

7KB
MD5

89c7af92adb69d1a3fcf11d90dd55bac
SHA1

18baa7d07f150278a3182f90c99906db07268142
SHA256

56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215
SHA512

d2e83d9c9432a47425393da7e9580fa889368302a839b940a45119cdf6fd359a2c2381cb9dff0f1b9c65329fab8ab05e405cf250d96a561c9bb62c5e83538437
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIJHNQ0EDm9H9G3EwDrR0rfEpL2FeW7gW:unSR6bgY8NrEDm9H9nw/qrfEx1WkW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2224	3000	rundll32.exe	29
PID 3000 wrote to memory of 2224	3000	rundll32.exe	29
PID 3000 wrote to memory of 2224	3000	rundll32.exe	29
PID 3000 wrote to memory of 2224	3000	rundll32.exe	29
PID 3000 wrote to memory of 2224	3000	rundll32.exe	29
PID 3000 wrote to memory of 2224	3000	rundll32.exe	29
PID 3000 wrote to memory of 2224	3000	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...