Resubmissions
25/04/2025, 03:24
250425-dybpssslt325/04/2025, 03:22
250425-dxdsrssls71013/04/2025, 09:37
250413-lljhwatshw1013/04/2025, 09:33
250413-ljk9patsex10Analysis
- max time kernel
102s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250410-en - resource tags
- submitted
25/04/2025, 03:22
General
- Target virusshare/2/VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe
- Size 2.9MB
- Sample250425-dxdsrssls7
- SHA256 3751298058a2a5d0912caa35bfdbafa48ae788647b536e69ad383c7c1990dd9d
Score
3/10
Malware Config
Signatures
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\virusshare\2\VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe"C:\Users\Admin\AppData\Local\Temp\virusshare\2\VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 4042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 4122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1076 -ip 10761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1076 -ip 10761⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1076-0-0x00000000023C0000-0x000000000262A000-memory.dmp
memory/1076-1-0x0000000002630000-0x0000000002897000-memory.dmp
memory/1076-8-0x00000000028A0000-0x0000000002B09000-memory.dmp
memory/1076-2-0x00000000028A0000-0x0000000002B09000-memory.dmp
memory/1076-16-0x0000000002B10000-0x0000000002D67000-memory.dmp
memory/1076-15-0x00000000028A0000-0x0000000002B09000-memory.dmp
memory/1076-17-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1076-18-0x0000000002630000-0x0000000002897000-memory.dmp