d65b5097ee97090bef4e0b8cfb5363385863f2b6a42486aa693e61b35caf294f

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2996-13-0x00000000004B0000-0x0000000001512000-memory.exe
Size

16.4MB
MD5

9f99a922a4bcbc0c86e9e0dc2fb68c17
SHA1

62a35e80a79712d9a4cd7dc0968fb3e3c2aa529a
SHA256

d65b5097ee97090bef4e0b8cfb5363385863f2b6a42486aa693e61b35caf294f
SHA512

d54b1ae86a3366f925911e7d9ba9dd5035acc3b05175959c3634b443950286a0dd1a164ddb21f76b468d2c3e8cc54a9d32958ee1c43fd92353cb0c748e6faecd
SSDEEP

3072:KuIYiRbaLfqIrm6f36QvyRZzfay9JSNNAcCljWq:ZPJa6fTvgas3jp

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1980 888 WerFault.exe 2996-13-0x00000000004B0000-0x0000000001512000-memory.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

2996-13-0x00000000004B0000-0x0000000001512000-memory.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2996-13-0x00000000004B0000-0x0000000001512000-memory.exe

pid	pid_target	process	target process
1980	888	WerFault.exe	2996-13-0x00000000004B0000-0x0000000001512000-memory.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2996-13-0x00000000004B0000-0x0000000001512000-memory.exe

C:\Users\Admin\AppData\Local\Temp\2996-13-0x00000000004B0000-0x0000000001512000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2996-13-0x00000000004B0000-0x0000000001512000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 216
  2⤵
  - Program crash
  PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 888 -ip 888
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads