0568e45dfc54c298f485c20a0a309764fc0008fd525e20e524d8ab00c348056e

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 15:27

Target

_glib.dll
Size

1.6MB
MD5

d3c97a47a0639db5e65ea7f25561d536
SHA1

2c311c2889143eb53027a652f3f95d14d2100a10
SHA256

70c2f0505cc84cc86749ee786450e790f2ac7d38ca0c7a9126b3ea625422f4d4
SHA512

dd35adc1dc9b8df8f3a641b46ab97a628cd10fbfff62059b10e0db3d0396b7eb5c0f580d9ebc767f82d5f4c7f4a63d8e2a8cc6ed2d9a01bf79415ec1bb093195
SSDEEP

24576:AyhDzjoYAc9CuVSzjV8j5Nmx0IZB+yKdF0AVWtv8ZmbdU:XHChx0IB3KdtWtv8MdU

Score

3^/10

discovery

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2336 492 WerFault.exe rundll32.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

rundll32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe

pid	pid_target	process	target process
2336	492	WerFault.exe	rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2908 wrote to memory of 492	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 492	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 492	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 492	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 492	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 492	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 492	2908	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 2336	492	rundll32.exe	WerFault.exe
PID 492 wrote to memory of 2336	492	rundll32.exe	WerFault.exe
PID 492 wrote to memory of 2336	492	rundll32.exe	WerFault.exe
PID 492 wrote to memory of 2336	492	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_glib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_glib.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 240
    3⤵
    - Program crash
    PID:2336

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/492-0-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download