156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf.exe
Size

3.0MB
MD5

14d8d7fc21c24c3068c872e2a2ed7c0e
SHA1

d9c9b7322da5080ef7e4c8833193ead64fe47219
SHA256

156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf
SHA512

23fe7d11c8f2326662350db07ca7523e58d20fba6416d33d10073be949cbf257d7770f31f675b6ac6fda2c6afea340f8ef477d4392c1d1c9be04de1f82bb7cd1
SSDEEP

49152:7Z4rujE/CLlVl80CdSI3LdmLgWtAjkhAb86LqmQKzeFH/LNqAznwlZ:7+ruj+CLflabdSgGhl6OFGUwL

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	524	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 2340	524	156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf.exe	31
PID 524 wrote to memory of 2340	524	156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf.exe	31
PID 524 wrote to memory of 2340	524	156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf.exe	31
PID 524 wrote to memory of 2340	524	156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf.exe	31

C:\Users\Admin\AppData\Local\Temp\156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf.exe
"C:\Users\Admin\AppData\Local\Temp\156f0332a4d46af543721db048eef6bf6b94a54938cfe01591a01c59c2fa5ecf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 260
  2⤵
  - Program crash
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-0-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/524-1-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download