5e8e0fa80a6ab936f94a262517ccc34ffcd7549edf50889db99b020de0e75433

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2025, 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e8e0fa80a6ab936f94a262517ccc34ffcd7549edf50889db99b020de0e75433.dll
Size

7.0MB
MD5

fe29a51a1654294ab29c17997136d769
SHA1

97d26a72778d21f1276475d31689c8de9667633e
SHA256

5e8e0fa80a6ab936f94a262517ccc34ffcd7549edf50889db99b020de0e75433
SHA512

d9ffa634225f71dfdb3255342b44db4f76b1c420dfa1b1472b3e4e01540fc6d2c81d55cf5765f25243743b6336fc0d5627ffac02ff78456efb5a98dfc9a29072
SSDEEP

98304:94pAEu/JCq0uT6NXOvyGzQg6x0l3XaGgcVGHkQQClgtiQ5wUBoQ4/5i:9f0Ge8Qx0l8cwrzQ5wUBJB

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	2284	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2284	4760	rundll32.exe	85
PID 4760 wrote to memory of 2284	4760	rundll32.exe	85
PID 4760 wrote to memory of 2284	4760	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e8e0fa80a6ab936f94a262517ccc34ffcd7549edf50889db99b020de0e75433.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e8e0fa80a6ab936f94a262517ccc34ffcd7549edf50889db99b020de0e75433.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 760
    3⤵
    - Program crash
    PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2284 -ip 2284
1⤵
PID:5480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads