5cd50d57a32b96d16db5abb18023bc202afffbb894060ef2f0d59f03f65a906e

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 16:58

Target

7zxa.dll
Size

74.0MB
MD5

07d13871d87503aeae53933e96f19092
SHA1

43db90420c6d4ad3ab82673e98cc26bf1ddd6818
SHA256

671246f3727180c5786222ac6571a2920c87c2f8949308cb555e46779d99c4bd
SHA512

3cecd709028e158b6b410dd9a711d496a7e4c2a86c0ba8a3a5d0e51eb0684ef2cb6a74ab29c1bbb47c01232c46a10db5b87bba1c9183097dcbcdc32d26d7e1e7
SSDEEP

393216:uUxdJAw7DhnN169W7sJa+kIUyNP4Tstvx/QYqHx4AJIa5yJBz7h8zxPtYLx5mYfW:duWQASLQqIBx4gIaIp8zxtYd5mYfc

Score

3^/10

discovery

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2792 2668 WerFault.exe rundll32.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

rundll32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

rundll32.exe

pid process

2668 rundll32.exe
2668 rundll32.exe
2668 rundll32.exe
2668 rundll32.exe

pid	pid_target	process	target process
2792	2668	WerFault.exe	rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2248 wrote to memory of 2668	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2668	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2668	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2668	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2668	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2668	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2668	2248	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 2792	2668	rundll32.exe	WerFault.exe
PID 2668 wrote to memory of 2792	2668	rundll32.exe	WerFault.exe
PID 2668 wrote to memory of 2792	2668	rundll32.exe	WerFault.exe
PID 2668 wrote to memory of 2792	2668	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7zxa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 524
3⤵
- Program crash
PID:2792

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2668-0-0x0000000002120000-0x0000000006BF6000-memory.dmp

Filesize
74.8MB

Download
memory/2668-2-0x0000000002120000-0x0000000006BF6000-memory.dmp

Filesize
74.8MB

Download