cb9cb093171875d5dcedaf2b7ed069a5138bd386baec796dfa3f19aea43617f8

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:50

Target

cb9cb093171875d5dcedaf2b7ed069a5138bd386baec796dfa3f19aea43617f8.dll
Size

4.6MB
MD5

17e5d6235f8b5170b2e002fbedae5b39
SHA1

e5ccaba820e6cff079c1ce88809e6755593de74f
SHA256

cb9cb093171875d5dcedaf2b7ed069a5138bd386baec796dfa3f19aea43617f8
SHA512

07af60831d07892f041e8977498ed782cacc7629e7e51b84f6b8049960ac79e49b5461ba968620fca91e7d0009405556e80ea3187a30f79f0642bafcc6b1395e
SSDEEP

98304:9RK1dm+O6P0DvHI/Tvyegz2UrrrjRyBEXp0/aeuZmQQLFXfoGku+i17/B:9S4+O6P5OeMRrjRy7aPZbm3k8V/B

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2084	rundll32.exe
2084	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2084	1884	rundll32.exe	30
PID 1884 wrote to memory of 2084	1884	rundll32.exe	30
PID 1884 wrote to memory of 2084	1884	rundll32.exe	30
PID 1884 wrote to memory of 2084	1884	rundll32.exe	30
PID 1884 wrote to memory of 2084	1884	rundll32.exe	30
PID 1884 wrote to memory of 2084	1884	rundll32.exe	30
PID 1884 wrote to memory of 2084	1884	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9cb093171875d5dcedaf2b7ed069a5138bd386baec796dfa3f19aea43617f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9cb093171875d5dcedaf2b7ed069a5138bd386baec796dfa3f19aea43617f8.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2084

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2084-6-0x000000007414D000-0x00000000743C9000-memory.dmp

Filesize
2.5MB

Download
memory/2084-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2084-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2084-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2084-9-0x0000000074130000-0x0000000074868000-memory.dmp

Filesize
7.2MB

Download
memory/2084-10-0x0000000074130000-0x0000000074868000-memory.dmp

Filesize
7.2MB

Download
memory/2084-11-0x0000000074130000-0x0000000074868000-memory.dmp

Filesize
7.2MB

Download
memory/2084-12-0x000000007414D000-0x00000000743C9000-memory.dmp

Filesize
2.5MB

Download