777f77c1c53c3551c89ef44c86c06cbfe0b2bb04374b7d7d9f6153d3ecc3c267

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

414cb3c4ac2d42889d7c55565afc0f57d2a0e9f7a186b5d5d8e5118fd3f976da.exe
Size

2.0MB
MD5

db87424723d41b8b4075c1e0cb33e01b
SHA1

a88fe56ef8789d939da5fff58b871b2028b64eed
SHA256

414cb3c4ac2d42889d7c55565afc0f57d2a0e9f7a186b5d5d8e5118fd3f976da
SHA512

ed970d754b3472098cec36bd7f6ad26254e4e0ddced625b3f93963b5eb275b626a1e5eeb08a6b573b60aa15946fd275f3743ceb6a37c94b1bf888f38907d4db7
SSDEEP

24576:7L81USHF/mAhAdMywT1KBgvJRtlpLklKuVy2NtD:w9Wdxk1KBClpP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1816	2228	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	414cb3c4ac2d42889d7c55565afc0f57d2a0e9f7a186b5d5d8e5118fd3f976da.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1816	2228	414cb3c4ac2d42889d7c55565afc0f57d2a0e9f7a186b5d5d8e5118fd3f976da.exe	30
PID 2228 wrote to memory of 1816	2228	414cb3c4ac2d42889d7c55565afc0f57d2a0e9f7a186b5d5d8e5118fd3f976da.exe	30
PID 2228 wrote to memory of 1816	2228	414cb3c4ac2d42889d7c55565afc0f57d2a0e9f7a186b5d5d8e5118fd3f976da.exe	30
PID 2228 wrote to memory of 1816	2228	414cb3c4ac2d42889d7c55565afc0f57d2a0e9f7a186b5d5d8e5118fd3f976da.exe	30

C:\Users\Admin\AppData\Local\Temp\414cb3c4ac2d42889d7c55565afc0f57d2a0e9f7a186b5d5d8e5118fd3f976da.exe
"C:\Users\Admin\AppData\Local\Temp\414cb3c4ac2d42889d7c55565afc0f57d2a0e9f7a186b5d5d8e5118fd3f976da.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 644
  2⤵
  - Program crash
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-0-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/2228-1-0x0000000000EC0000-0x00000000010CA000-memory.dmp

Filesize
2.0MB

Download
memory/2228-2-0x00000000005C0000-0x00000000005CE000-memory.dmp

Filesize
56KB

Download
memory/2228-3-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2228-4-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/2228-5-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download