eb5dcbde491776a5abe1340f2653684ab8a0e7b0f0c68a3a7787d2e97dff329a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06-11-2024 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

413cf6a694eef7a4f1725a11938f1ab2df1957bfb3bf20cf6a47017bebbad2a9.dll
Size

43KB
MD5

798d5713512b5cb6228138ceea7c8066
SHA1

aa9197b154d0cf0ae1867e2b7befe56030c8609f
SHA256

413cf6a694eef7a4f1725a11938f1ab2df1957bfb3bf20cf6a47017bebbad2a9
SHA512

b6c55a1a4f79dab387636b0214528baa833bb71faf55218380bb308d53e617e5be7cafbe40c2aa5eda60122a37578fdc51c2c9af7c98fd81a4df2188be17c79b
SSDEEP

768:nmEpMZSMa44sl1paFt5XJ2Wt8W2rsbdcOJNm17g40NxWhTL:njMZSJ44Nt5XJ2WuWCWcOJM17YCTL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2564	2368	rundll32.exe	30
PID 2368 wrote to memory of 2564	2368	rundll32.exe	30
PID 2368 wrote to memory of 2564	2368	rundll32.exe	30
PID 2368 wrote to memory of 2564	2368	rundll32.exe	30
PID 2368 wrote to memory of 2564	2368	rundll32.exe	30
PID 2368 wrote to memory of 2564	2368	rundll32.exe	30
PID 2368 wrote to memory of 2564	2368	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\413cf6a694eef7a4f1725a11938f1ab2df1957bfb3bf20cf6a47017bebbad2a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\413cf6a694eef7a4f1725a11938f1ab2df1957bfb3bf20cf6a47017bebbad2a9.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads