765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9N.exe
Size

118KB
MD5

967e4a5a3608a5e3acea1874f7dc82c0
SHA1

3d8771a66962163ec1d481b601cf1323f3fd3958
SHA256

765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9
SHA512

2b7ace2f4220a847b46e3ebec6a5d61cb1b8b5724e5833bcde77495a6bbbcda953286482ab90196e25918deafd385ad45f19e05dd81abfde6eb065e407806fef
SSDEEP

1536:ZVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApEVkyINWhCyqaOIgo8tyo:pnxwgxgfR/DVG7wBpEO5NWhCaORpt7

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	2340	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2272	2340	765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9N.exe	30
PID 2340 wrote to memory of 2272	2340	765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9N.exe	30
PID 2340 wrote to memory of 2272	2340	765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9N.exe	30
PID 2340 wrote to memory of 2272	2340	765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9N.exe	30

C:\Users\Admin\AppData\Local\Temp\765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9N.exe
"C:\Users\Admin\AppData\Local\Temp\765e5315d1ef2dba0b7c342ea73aab387902497c302df124fbf13bdff98bbad9N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 100
  2⤵
  - Program crash
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2340-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download