Analysis
- max time kernel
119s - max time network
124s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
04/11/2024, 08:48
General
- Target Firefoxw.png.exe
- Size 1018KB
- Sample241104-kqfgca1jbl
- SHA256 c65e46835a560930553b80f33dfc73f9d67bf95cf6074bc55ce9fa8ccfbe176f
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Firefoxw.png.exe"C:\Users\Admin\AppData\Local\Temp\Firefoxw.png.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 8722⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2112-0-0x000000007483E000-0x000000007483F000-memory.dmp
memory/2112-1-0x0000000000D40000-0x0000000000E44000-memory.dmp
memory/2112-2-0x0000000000970000-0x00000000009C8000-memory.dmp
memory/2112-3-0x0000000074830000-0x0000000074F1E000-memory.dmp
memory/2112-4-0x0000000004E00000-0x0000000004E6E000-memory.dmp
memory/2112-5-0x000000007483E000-0x000000007483F000-memory.dmp
memory/2112-6-0x0000000074830000-0x0000000074F1E000-memory.dmp
memory/2112-7-0x0000000074830000-0x0000000074F1E000-memory.dmp