0568e45dfc54c298f485c20a0a309764fc0008fd525e20e524d8ab00c348056e

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 15:27

Target

_converter.dll
Size

40KB
MD5

8f73fb2a063127ec988dbadea5726566
SHA1

93c9419d26f92aa8e366a1f3bbd5ae33c75d72f6
SHA256

aa0c415f9383ee1ca1209acabb90523076c3c09242fcc5fdc43cc84d3fc7a79c
SHA512

93d885964637a48077ecd28883c9fad21aa92a92746c9545d28e6dcc2d805e47f649e0e593f7f00ce68a45226e8ad6a9692c5503d810126c65efb77ccc2668c2
SSDEEP

768:mqKSBKWrXrcmKp6VCXPUl+ltO16rOlbcPX/9Gh:LnsW7XjVCXPUl+ltO1F5c/Qh

Score

3^/10

discovery

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1932 2628 WerFault.exe rundll32.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

rundll32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe

pid	pid_target	process	target process
1932	2628	WerFault.exe	rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1772 wrote to memory of 2628	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2628	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2628	1772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_converter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_converter.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 700
    3⤵
    - Program crash
    PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2628 -ip 2628
1⤵
PID:2772

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2628-0-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2628-6-0x00000000020A0000-0x0000000002122000-memory.dmp

Filesize
520KB

Download
memory/2628-8-0x00000000021F0000-0x00000000022A6000-memory.dmp

Filesize
728KB

Download
memory/2628-20-0x0000000002790000-0x0000000002933000-memory.dmp

Filesize
1.6MB

Download
memory/2628-18-0x0000000002760000-0x0000000002774000-memory.dmp

Filesize
80KB

Download
memory/2628-16-0x0000000002640000-0x0000000002745000-memory.dmp

Filesize
1.0MB

Download
memory/2628-14-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2628-12-0x00000000022B0000-0x00000000025D5000-memory.dmp

Filesize
3.1MB

Download
memory/2628-10-0x0000000002140000-0x00000000021F0000-memory.dmp

Filesize
704KB

Download
memory/2628-4-0x0000000002010000-0x0000000002092000-memory.dmp

Filesize
520KB

Download
memory/2628-3-0x0000000001F80000-0x0000000002002000-memory.dmp

Filesize
520KB

Download