fc10f8a2cb7e5b03783b730fd3446f94ad4f86276ef9259a73b2bcba910da11d

Analysis

max time kernel
101s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
23/06/2025, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PRODUCTION 1127UC.exe
Size 1.2MB
Sample250623-2pt2savns8
SHA256 fc10f8a2cb7e5b03783b730fd3446f94ad4f86276ef9259a73b2bcba910da11d
MD5 ec89cdaeafe42f9ab99f71428afa4a4e
SHA1 440167416f2871957567a0207884256434b17a8d
SHA512 5f21c55d2c45d83d77713e7bf965bc57380271f6036ca3b1b684002f4613d363d398c6a6ca442eef41f7b60c140e827891a580ddb0570e39c2780661cc1ece34
SSDEEP 24576:85EmXFtKaL4/oFe5T9yyXYfP1ijXdaPP4pAKaMZSMnPfRhj7MPBQ6mp:8PVt/LZeJbInQRaPQSmrnHW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5052	4556	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PRODUCTION 1127UC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4768	4556	PRODUCTION 1127UC.exe	82
PID 4556 wrote to memory of 4768	4556	PRODUCTION 1127UC.exe	82
PID 4556 wrote to memory of 4768	4556	PRODUCTION 1127UC.exe	82

C:\Users\Admin\AppData\Local\Temp\PRODUCTION 1127UC.exe
"C:\Users\Admin\AppData\Local\Temp\PRODUCTION 1127UC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\PRODUCTION 1127UC.exe"
  2⤵
  PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 676
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4556 -ip 4556
1⤵
PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut8146.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut8146.tmp
Size 264KB
SHA256 a7b178f9c8ad9a18f43a3c85658f38d4a02d6078713dea9aaa52b267490153c9
MD5 246f35a182c4cc6d6be287cccb6448bc
SHA1 e630faae7493d01f18339c0c7dfa1bbeb2978ad7
SHA512 b7842e4d04aeb9b1a541b78f0ac61bf067af4a23b269486f0f192ba5be9e8afc116abd574251af0952506803963f021a68fb4651366a3ee56d3e87d84174a486
SSDEEP 6144:2uUj82Zhzljb6pth0EbSfw2EZhkMvPlD3xKc784Dn4d5mzO+:2lw2F2ptBD2EZCO59n4jmzD
MD5 SHA1 SHA512 SSDEEP

Submit Download