Analysis
-
max time kernel
20s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 09:41
Static task
static1
Behavioral task
behavioral1
Sample
521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32.exe
Resource
win7-20240903-en
General
-
Target
521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32.exe
-
Size
1.3MB
-
MD5
54dcb04f09203c68c597c0d5328f1b46
-
SHA1
429cdced3687a9b607606835c88540ec73747eb9
-
SHA256
521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32
-
SHA512
4943b3c98a96a4961f6f08fbe539e7ca3e64f394a8220c949ed01de75d4de34f6cc5c51971c15b638c5bd698c37309b48fd06f18cff87194c8cf3d4cb97a1d25
-
SSDEEP
24576:SJeofAq/jp98z3kiZgV+PBeOeOe7OxmOocRLfzyFyT96I:IeofAaWkQKuBeOeOe7OxmHcR1d
Malware Config
Signatures
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x00000000004B3000-memory.dmp autoit_exe behavioral1/memory/2316-1-0x0000000000400000-0x00000000004B3000-memory.dmp autoit_exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2696 2316 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2696 2316 521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32.exe 30 PID 2316 wrote to memory of 2696 2316 521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32.exe 30 PID 2316 wrote to memory of 2696 2316 521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32.exe 30 PID 2316 wrote to memory of 2696 2316 521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32.exe"C:\Users\Admin\AppData\Local\Temp\521551502cef501862a6440441f0c76ab9559097d3850cf3de2c4b8ec34dbd32.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 2042⤵
- Program crash
PID:2696
-