3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a.exe
Size

1.7MB
MD5

64b7609dc5f4f91ba908efe2d8af3a03
SHA1

fb5443aff16539172554c1263b42e6e5825f9997
SHA256

3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a
SHA512

c838c42223f7380adb62d32579b7bd2d7a502cc2c31b0f36e60b3ccf33ddb6d1bf5296831896c031d9eac224c75f8ab791845c2f98551e36735972a22b9d393b
SSDEEP

49152:X+aSDR3ZqU8tO0cZZZ+rnoZAUwY0cJsGzAqk:Xqpqq0cZZo

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	2868	WerFault.exe	27

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2908	2868	3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a.exe	28
PID 2868 wrote to memory of 2908	2868	3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a.exe	28
PID 2868 wrote to memory of 2908	2868	3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a.exe	28
PID 2868 wrote to memory of 2908	2868	3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a.exe	28

C:\Users\Admin\AppData\Local\Temp\3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a.exe
"C:\Users\Admin\AppData\Local\Temp\3435459dd80fd54233099dd834eb2ea607d8293534a0f562785ae2af7dc3986a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 256
  2⤵
  - Program crash
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads