99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4.exe
Size

3.0MB
MD5

2e7e81d140f2bd9bcc1633a207ef9b23
SHA1

4e17af5ad3a12e5aa36778daf2cc2054d2f4763a
SHA256

99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4
SHA512

086ed004cae8a0aa2d635ba7d31cd57425b27b5a89f10c0ded9e422d9ae7b0977da51e2baacae09460ecfa2ad19a016c8dfabc748243b9a3272f97937d613630
SSDEEP

49152:9Z4rujE/CLlVl80CdSI3LdmLgWtAjkhAN86LqmQKzeFH/LNqAznwn90d:9+ruj+CLflabdSgGhj6OFGUwn90d

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	2096	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1028	2096	99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4.exe	30
PID 2096 wrote to memory of 1028	2096	99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4.exe	30
PID 2096 wrote to memory of 1028	2096	99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4.exe	30
PID 2096 wrote to memory of 1028	2096	99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4.exe	30

C:\Users\Admin\AppData\Local\Temp\99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4.exe
"C:\Users\Admin\AppData\Local\Temp\99e3c9fa3f34d684d88e6c48b31cab47350d78d7437947bc7894663de2f171a4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 256
  2⤵
  - Program crash
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-0-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/2096-1-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download