e9b99706a9b48b09974dd18c1af8a0e402ccddcaa0c91edf43fdd838128a7408

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 02:14

Target

17697e1829f0d18d2051a67bc2bca134_da3ded254909e9abaa46eb5bc3b10944.dll
Size

288KB
MD5

17697e1829f0d18d2051a67bc2bca134
SHA1

d3f6bd8b57a8c353fd3f25d66e0690d9f578d35e
SHA256

ab7a58b6e50be6b9bcb926c550ff26669601bbd8bfd922a5b32756e663b25a67
SHA512

043807916717c72b2265915fa0a99688946f384286d3bf637646f38b5dcc6860b71c8f4896000d136f7ae18eb808537391f43991234ec25c1700872662ab53e4
SSDEEP

3072:g9OePfXFnSzjrF4SAiInBfe54R0nANPJYCWupbjvlx1X2qpOCFIQ4OWd6nWWBSJ/:eVdSzjtAfHRNrW8bjlHIIIHL

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

rundll32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2400 wrote to memory of 2376	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 2376	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 2376	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 2376	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 2376	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 2376	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 2376	2400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17697e1829f0d18d2051a67bc2bca134_da3ded254909e9abaa46eb5bc3b10944.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17697e1829f0d18d2051a67bc2bca134_da3ded254909e9abaa46eb5bc3b10944.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2376

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2376-0-0x00000000751F8000-0x00000000751FA000-memory.dmp

Filesize
8KB

Download