c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786.exe
Size

348KB
MD5

239f9b69cff9b615d0d137c7c4d95ab9
SHA1

b455019b0ae6e89fcc47ff31460dd49536c133b2
SHA256

c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786
SHA512

013997c6697704f7d3a2053a28e22cf9b9b340ba5747638d340e03d982ee45053d685bd6440e978497996ba1436db58c2b87d54be3764175ea6a8490556caa2f
SSDEEP

6144:io+AdpbEPf4Qn65VGQgpYZPqIpSWZfX817+eiaGGPUVm:io3CPQosVhgwPqUeRDPum

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	2340	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2984	2340	c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786.exe	31
PID 2340 wrote to memory of 2984	2340	c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786.exe	31
PID 2340 wrote to memory of 2984	2340	c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786.exe	31
PID 2340 wrote to memory of 2984	2340	c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786.exe	31

C:\Users\Admin\AppData\Local\Temp\c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786.exe
"C:\Users\Admin\AppData\Local\Temp\c8738618b93613ebc2f8e53cf61326dad58246448b4a902a846c1aefe992d786.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 132
  2⤵
  - Program crash
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2340-1-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download