Analysis

  • max time kernel
    32s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2025, 22:04

General

  • Target

    619d2a99c3fa3fb33e1fb88a7d962895cc66e372decb11ec643045e8b7e53d4d.exe

  • Size

    2.8MB

  • MD5

    0466af339b2926ac6572d3fa14cd3dce

  • SHA1

    ebb4b856f8562c26ea507d2102de3d7a02b4ed25

  • SHA256

    619d2a99c3fa3fb33e1fb88a7d962895cc66e372decb11ec643045e8b7e53d4d

  • SHA512

    df1a566c0b0e6e008b3648a211910d0f0d25a2fe17ff641f55c13db7b385b5b0974ce283e11b5be4c64e692a701d32abd5a17e441625ef7242b30894f8dede2c

  • SSDEEP

    49152:X5AfTBYfeaqsf1P4P2i0kv9uJT/wzVkU8TRspLQogkQ234M5yAP2wQy:XGNaBdQP2pkvyTY5k3Cpmk9oM5yAx

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 5 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\619d2a99c3fa3fb33e1fb88a7d962895cc66e372decb11ec643045e8b7e53d4d.exe
    "C:\Users\Admin\AppData\Local\Temp\619d2a99c3fa3fb33e1fb88a7d962895cc66e372decb11ec643045e8b7e53d4d.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 156
      2⤵
      • Program crash
      PID:2332

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3052-0-0x0000000000400000-0x00000000006DF000-memory.dmp

          Filesize

          2.9MB

        • memory/3052-2-0x0000000000400000-0x00000000006DF000-memory.dmp

          Filesize

          2.9MB