7e8eb69adadb7337fa6a7b18c08b7d3f1ccef733157db636f23e5ec3603a2550

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/Dialer.dll
Size

4KB
MD5

b5be0e441e04e5bf077a90097b169d22
SHA1

22fdf908102ae4f45e45b354e2f28a9ac17eb684
SHA256

7f267c0c300ee645624dbff22329d8a1e86c2e147ee803a34c43bdee76da0255
SHA512

3cfc02b01e67cea80354de4725ec66fc1314ef68ec577a2d6f9f9bb6f8c450c777fd3ce32c21a59b935b401151221d1506d7c795dcd4e59edcf9d6a15b14c2d6

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	3040	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3040	2648	rundll32.exe	30
PID 2648 wrote to memory of 3040	2648	rundll32.exe	30
PID 2648 wrote to memory of 3040	2648	rundll32.exe	30
PID 2648 wrote to memory of 3040	2648	rundll32.exe	30
PID 2648 wrote to memory of 3040	2648	rundll32.exe	30
PID 2648 wrote to memory of 3040	2648	rundll32.exe	30
PID 2648 wrote to memory of 3040	2648	rundll32.exe	30
PID 3040 wrote to memory of 2268	3040	rundll32.exe	31
PID 3040 wrote to memory of 2268	3040	rundll32.exe	31
PID 3040 wrote to memory of 2268	3040	rundll32.exe	31
PID 3040 wrote to memory of 2268	3040	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 228
    3⤵
    - Program crash
    PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads