c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09.exe
Size

949KB
MD5

7f78975af2cf31464f9e96b1183641a0
SHA1

20894f326c50adcc32d1959b203a1958581f3bf9
SHA256

c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09
SHA512

35a6c093e505cf2c5d73d7d31cabdc537a6cae0c5c26aca00f1f329199532ad4246a96802ee0b5f9bccf3ae06a7f45c36d8b902ef4f8d3f7480f862e23b31fe9
SSDEEP

24576:WuuBj3ZXqv05z21PP1MHmGSJrZ5dUYqnF86+:WV5q85AMGGSZZ5d1h6+

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	1824	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1740	1824	c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09.exe	30
PID 1824 wrote to memory of 1740	1824	c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09.exe	30
PID 1824 wrote to memory of 1740	1824	c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09.exe	30
PID 1824 wrote to memory of 1740	1824	c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09.exe	30

C:\Users\Admin\AppData\Local\Temp\c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09.exe
"C:\Users\Admin\AppData\Local\Temp\c3d6495098f1840c9ef546bd838638e7e631c04f22db0792bbe94e483a1a6e09.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 36
  2⤵
  - Program crash
  PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download