3d67c0d1e4c75a92693b640144e34ca8aae46615c76bfcf9f6dbd6a992f8a838

Analysis

max time kernel
137s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3208-22-0x0000000000450000-0x00000000016A4000-memory.exe
Size

18.3MB
MD5

a7299ca1c00e36fe5b59f27733114e4d
SHA1

1362da04b0d10fd49dc46e9029f013cfaed91ebd
SHA256

3d67c0d1e4c75a92693b640144e34ca8aae46615c76bfcf9f6dbd6a992f8a838
SHA512

ddd94c294b357b64c5cdd673d24c9cca685c1b08be6ca02d3b9b97307f31142c0d8256e8f00b8fc39c854fb2b7f1bef4ef6f8ca8e947411a6335d155b0cc8a12
SSDEEP

3072:KPe4b7aVpWsN/62ValtTjWyBNuvT4gG3VMCvq:pvh/VQW4VVMCS

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4964 3084 WerFault.exe 3208-22-0x0000000000450000-0x00000000016A4000-memory.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

3208-22-0x0000000000450000-0x00000000016A4000-memory.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3208-22-0x0000000000450000-0x00000000016A4000-memory.exe

pid	pid_target	process	target process
4964	3084	WerFault.exe	3208-22-0x0000000000450000-0x00000000016A4000-memory.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3208-22-0x0000000000450000-0x00000000016A4000-memory.exe

C:\Users\Admin\AppData\Local\Temp\3208-22-0x0000000000450000-0x00000000016A4000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3208-22-0x0000000000450000-0x00000000016A4000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 216
  2⤵
  - Program crash
  PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3084 -ip 3084
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads