0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1.exe
Size

3.0MB
MD5

48bc36e6d335022fd7e9570f3288326f
SHA1

15d2e10afc6e1e257f109a95e4fc38350d5b203b
SHA256

0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1
SHA512

6655cd45063199bb1c6b5a38d4cf345a64153be308b4983eaa57f0ac79927c029056a472f72612afcf05750f81c30946f72992efacc68cfe620b0c103fde5842
SSDEEP

49152:mZ4rujE/CLlVl80CdSI3LdmLgWtAjkhAF86LqmQKzeFH/LNqAznwnIffk:m+ruj+CLflabdSgGhz6OFGUwIU

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	2336	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2296	2336	0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1.exe	31
PID 2336 wrote to memory of 2296	2336	0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1.exe	31
PID 2336 wrote to memory of 2296	2336	0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1.exe	31
PID 2336 wrote to memory of 2296	2336	0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1.exe	31

C:\Users\Admin\AppData\Local\Temp\0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1.exe
"C:\Users\Admin\AppData\Local\Temp\0cd48a01ae87aa219abe4bb9535507cb54e8958e5b46b7892f87a7de5adab4c1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 256
  2⤵
  - Program crash
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2336-1-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download