a037b821e1235090e074ec007020a635eb41df46106dc9a0d192cd4461e630cc

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TestProj.dll
Size

21KB
MD5

b4c007c9a2638a09d8872ba51dd61ac2
SHA1

55d1bb5f4128ab1aecd5ea5768da89c6671cdb47
SHA256

3979d4ad8ea65508ed096e57c338eca5171ab1b7cc05ff266792116ed41ec679
SHA512

5b725e9f6517cdf09a2eb0966d61fce5dc86a6a2f325538b07d1e604d8c3b552e74f6ad8db0c7442377033032700763a2afa84fbbe08998a3012300bc6080b33
SSDEEP

384:+NczJ4syB16lMbAaW4Vd8M2tRNCCi9SSYfOIzi/fPa8hnnnnn6:GczA4l2W4VotRNNisti3yunnn6

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	2532	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2532	2324	rundll32.exe	30
PID 2324 wrote to memory of 2532	2324	rundll32.exe	30
PID 2324 wrote to memory of 2532	2324	rundll32.exe	30
PID 2324 wrote to memory of 2532	2324	rundll32.exe	30
PID 2324 wrote to memory of 2532	2324	rundll32.exe	30
PID 2324 wrote to memory of 2532	2324	rundll32.exe	30
PID 2324 wrote to memory of 2532	2324	rundll32.exe	30
PID 2532 wrote to memory of 1760	2532	rundll32.exe	31
PID 2532 wrote to memory of 1760	2532	rundll32.exe	31
PID 2532 wrote to memory of 1760	2532	rundll32.exe	31
PID 2532 wrote to memory of 1760	2532	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TestProj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TestProj.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 276
    3⤵
    - Program crash
    PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads